Get certified. Stay protected.

It depends on your contracts and how much risk you're comfortable carrying. Cyber Essentials is mandatory if you work on UK government contracts that involve handling sensitive or personal data, or providing certain technical products and services. Beyond compliance, it's worth considering if your business holds customer data, uses cloud services, or has staff working remotely. The five controls it requires are increasingly what insurers and larger clients expect to see.

Cyber Essentials is mandatory for suppliers bidding for certain UK government contracts — specifically those involving sensitive information or technical services. It is not a blanket legal requirement for all UK businesses. However, it is increasingly required by larger organisations as a condition of doing business with them, and many cyber liability insurers use it as a benchmark when assessing risk.

For most small businesses, the process takes between two and six weeks from start to certification. A straightforward environment with modern cloud-based tools (e.g. Microsoft 365) can be ready in two to three weeks. Businesses with older infrastructure, on-premise servers, or multiple sites typically need longer to remediate gaps before assessment. Our gap review will give you a realistic timeline for your specific setup.

Yes - for several practical reasons beyond the badge. Certification requires you to implement the five technical controls that block the majority of untargeted cyber attacks. Smaller organisations may also qualify for bundled cyber insurance through the certification scheme, depending on eligibility. As clients and procurement teams increasingly ask for it, certification is becoming a practical requirement.

Yes. Malware protection is one of the five mandatory controls. You need active, up-to-date anti-malware software across all devices within the certification scope, along with controls that prevent unknown software from running. Where anti-malware isn't used, application whitelisting is accepted as an alternative. The assessment will verify that your approach meets the current NCSC requirements.

Cyber Essentials is a self-assessment. You answer a questionnaire declaring that your controls meet the standard, and an assessor reviews your answers. Cyber Essentials Plus includes everything in the base certification, plus an independent technical audit where an assessor tests your systems directly, scanning for vulnerabilities, testing email filtering and verifying that controls are in place. Plus provides stronger assurance and is required for some higher-risk government contracts.

There are two separate costs. The independent assessment fee is set by IASME and paid to the certification body, not to Montalex. It varies by organisation size: • £320 + VAT for micro-organisations (0–9 employees) • £440 + VAT for small organisations (10–49 employees) • £500 + VAT for medium organisations (50–249 employees) • £600 + VAT for large organisations (250+ employees) Montalex preparation packages start at £500 + VAT. For example, an organisation with 0–9 employees that fits the Essentials scope would pay £500 for preparation plus £320 for the assessment, a total of £820 + VAT. Employee count sets the assessment fee band, while the number of users and devices sets the preparation package. Totals exclude any extra remediation work, software licences or hardware your environment may need.

No. Montalex provides preparation support only. The assessment and award of certification are carried out by an independent certification body licensed by IASME. Holding Cyber Essentials ourselves does not make us a certification body. We help you get ready and answer technical questions along the way, and the certification body makes the decision.