Protection against malware

What the requirement asks

Malware protection is to be implemented and backed by appropriate user awareness. Purpose: protect information and associated assets from malware. Guidance: protection combines detection and repair software with awareness, suitable system access and change controls, since detection software alone is rarely enough. Consider: measures that stop or spot unapproved software, such as application allowlisting (8.19, 8.32); controls that prevent or detect visits to sites known or suspected to be malicious, such as blocklists; reducing vulnerabilities malware could exploit through vulnerability management (8.8, 8.19); regular automated validation of system software and data, especially for critical processes, investigating unapproved files or changes; protections against risks from obtaining files and software from or through external networks or other media; installing and keeping updated detection and repair software that scans computers and media, including scanning data received over networks or on media before use, scanning email and messaging attachments and downloads before use at several points such as mail servers, desktops and the network boundary, and scanning web pages when accessed; placing and configuring tools according to risk assessment, applying defence in depth (for example at network gateways for email, file transfer and web, and on endpoints and servers) and accounting for evasion such as encrypted files or encrypted transport; guarding against malware introduced during maintenance and emergency procedures that bypass normal controls; a process to authorize temporary or permanent disabling of protections, with approval authorities, documented justification and a review date; continuity arrangements for recovery after a malware attack with online and offline backups and recovery measures (8.13); isolating environments where outcomes could be catastrophic; procedures and responsibilities for malware protection, including training, reporting and recovery; awareness and training for all users on recognizing and limiting infected emails, files and programs (6.3); regularly gathering information on new malware from mailing lists or relevant sites; and checking that malware warnings come from qualified, reputable sources and are accurate. Other information: some systems such as certain industrial control systems cannot run anti-malware software, and some malware infects operating systems and firmware so deeply that a full reimage, sometimes including firmware, is needed. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Malware protection needs coverage and update evidence. The guidance asks for the layers, the update, the alert and the response.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep anti-malware deployment and update status reports across endpoints, servers and gateways and one live sample together.

Evidence an assessor asks for

• Anti-malware controlsAnti-malware deployment and update status reports across endpoints, servers and gateways
• Anti-malware controlsApplication allowlisting and malicious website blocking configurations
• Anti-malware controlsEmail, download and web scanning configuration at gateways and endpoints, including handling of encrypted content
• Anti-malware controlsApproved exception records for disabled protections with justification, approver and review date
• Anti-malware controlsMalware recovery plans with offline backups and evidence of restore testing
• Anti-malware controlsUser awareness material on malware and records of threat information sources monitored

The question an assessor will ask

An assessor will ask for anti-malware deployment and update status reports across endpoints, servers and gateways, then trace it to the system it protects. For A.8.7 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Anti-malware is deployed but signature updates fail silently on some hosts
• Protections are disabled for performance without a recorded exception or review date
• Backups are online only and would be encrypted by ransomware
• Systems that cannot run anti-malware, such as industrial controllers, have no compensating isolation

Before the next audit

Before the next audit, check one live sample for this gap: anti-malware is deployed but signature updates fail silently on some hosts.