Get certified. Stay protected.

It depends on your contracts and risk appetite. Cyber Essentials is mandatory if you work on UK government contracts that involve handling sensitive or personal data, or providing certain technical products and services. Beyond compliance, it is worth considering if your business holds customer data, uses cloud services, or has staff working remotely — the five controls it requires are the baseline most insurers and enterprise clients now expect.

Cyber Essentials is mandatory for suppliers bidding for certain UK government contracts — specifically those involving sensitive information or technical services. It is not a blanket legal requirement for all UK businesses. However, it is increasingly required by larger organisations as a condition of doing business with them, and many cyber liability insurers use it as a benchmark when assessing risk.

For most small businesses, the process takes between two and six weeks from start to certification. A straightforward environment with modern cloud-based tools (like Microsoft 365) can be ready in two to three weeks. Businesses with older infrastructure, on-premise servers, or multiple sites typically need longer to remediate gaps before assessment. Our gap assessment call will give you a realistic timeline for your specific setup.

Yes — for several practical reasons beyond the badge. Certification requires you to implement the five technical controls that block the majority of opportunistic cyber attacks. Smaller organisations may also qualify for bundled cyber insurance through the certification scheme, depending on eligibility. And as clients and procurement teams increasingly ask for it, having it removes a barrier to winning work.

Yes. Malware protection is one of the five mandatory controls. The requirement covers having active, up-to-date anti-malware software across all in-scope devices, controls to prevent execution of unknown software, and — where anti-malware is not used — application whitelisting as an alternative. The assessment will verify that your approach meets the current NCSC requirements for malware protection.

Cyber Essentials is a self-assessment: you answer a questionnaire declaring that your controls meet the standard, and an assessor reviews your answers. Cyber Essentials Plus includes everything in the base certification, plus an independent technical audit where an assessor tests your systems directly — scanning for vulnerabilities, testing email filtering, and verifying controls are in place. Plus provides stronger assurance and is required for some higher-risk government contracts.

The certification body fee is set by IASME and varies by organisation size: £320 + VAT for micro-organisations (0–9 employees), £440 + VAT for small organisations (10–49 employees), £500 + VAT for medium organisations (50–249 employees), and £600 + VAT for large organisations (250+ employees). On top of that, preparation and support costs vary depending on how ready your environment is. Montalex offers fixed-price packages from £500 for guided self-assessment through to £1,500+ for full technical remediation and submission support. Most businesses find the all-in cost falls between £900 and £2,500 depending on size and complexity.