The Law Society circulated a post-quantum cryptography checklist to large England and Wales firms on Friday, translating National Cyber Security Centre TLS guidance into board questions about client confidentiality, escrow data, and litigation hold systems.
The email landed two days after the NCSC published refreshed recommendations on 15 October, endorsing hybrid post-quantum and traditional cipher suites for TLS 1.3 while reminding organisations that older protocol versions will not receive quantum-safe upgrades.
Why solicitors care
Magic Circle and mid-tier firms host vast document repositories reachable over HTTPS APIs used by clients, barristers, and e-discovery vendors. A broken TLS configuration does not just leak passwords; it can expose privileged material mid-deal. Regulators already treat cyber failures as conduct issues, not mere IT glitches.
The Law Society’s checklist asks managing partners whether they can inventory every TLS termination point, including legacy case-management appliances that vendors have not patched in years. Firms must assume harvest-now-decrypt-later attacks target M&A data years before deals close, the guidance states.
NCSC technical baseline
The NCSC blog, written by principal technical director Jeremy B, recommends both hybrid and pure post-quantum configurations where libraries support them, with TLS 1.3 as the minimum version. Pure options await final IETF standards, but stable implementations already ship in major open-source stacks.
For law firms, the practical work is certificate agility: rotating keys without downtime for partners working across time zones. The checklist suggests quarterly tests on client extranets and mandates logging when cipher suites fall back to non-quantum-safe options.
Supply-chain pressure
Many firms depend on managed service providers for hosting. The Law Society asks for contractual clauses requiring MSPs to follow NCSC profiles by 2031, the centre’s high-priority migration horizon. Smaller practices without dedicated security officers are pointed to NCSC’s small-business guidance and Cyber Essentials Plus.
Insurers underwriting cyber policies have begun asking about post-quantum readiness in renewal questionnaires. Brokers said firms that cannot answer will face higher premiums even if no quantum computer yet threatens RSA keys.
Next steps for partners
IT committees are scheduling workshops with barristers’ chambers that share document portals, ensuring the entire litigation chain moves together. Clients in regulated sectors—banks, NHS trusts, and listed issuers—are also forwarding the NCSC guidance downstream, which accelerates law firm timelines.
The Law Society plans a follow-up webinar in November with NCSC participation. Until then, the checklist is the authoritative nudge for a profession that cannot treat TLS upgrades as someone else’s basement project.
Litigation technology vendors
E-discovery platforms that host terabytes of PDFs must re-encrypt data at rest and in transit when TLS profiles change. Vendors told firms they will schedule maintenance windows in late November, but only if clients approve downtime for active matters.
Chambers sharing secure rooms for barristers rely on the same ciphers as City firms. The checklist urges clerks to confirm Wi-Fi configurations in the Temple and South Square buildings, where legacy access points occasionally default to outdated protocols for compatibility with aging laptops.
Junior lawyers on secondment to client sites were reminded to verify VPN clients on personal laptops, a common weak point when firms mandate upgrades on office hardware but not on hybrid workers. The checklist includes a sample attestation letter partners can send to clients confirming TLS profiles on matter-specific extranets.