Answering the malware protection questions (A8)

The malware questions check that every in-scope device has an active malware protection mechanism. There are two accepted options: anti-malware software, or application allow listing (only approved, code-signed apps can run). Most organisations with laptops and phones use both: anti-malware on Windows and Mac computers, and allow listing through the app store on phones and tablets. A good answer says which option covers which devices and how it is configured.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

What the questions are checking

Which option covers each device (A8.1)

You select every option in use across your devices:

• Option A, anti-malware software. The requirements describe this option for Windows and macOS devices, including servers, desktops and laptops.
• Option B, application allow listing. An option for all devices, for example an app store with a list of approved apps, often managed with MDM.
• Option C, none of the above. You must explain, and in practice a device with neither A nor B will not meet the requirement.

Built-in protection is fine. Microsoft Defender Antivirus on Windows and XProtect on macOS are both accepted, as are commercial products, provided they are configured as below. List the product and version in the update section too (A6.2.2).

For Linux computers and servers, select Option A and name the product. Apexward, as a Certification Body, requires anti-malware software on Linux computers and servers as well. ClamAV with on-demand scanning meets this requirement, provided its signatures are kept up to date. If another Certification Body marks your assessment, check how it treats Linux devices.

If you use anti-malware software (A8.2 and A8.3)

The software must:

• update in line with the vendor's recommendations, which normally means automatic signature and engine updates
• prevent malware from running and block malicious code, which means real-time or on-access protection, not just scheduled scans (on Linux, ClamAV with on-demand scanning is accepted, as above)
• prevent connections to known malicious websites, either in the anti-malware product or the browser, for example Microsoft Defender SmartScreen

A good answer: "Microsoft Defender Antivirus on all Windows 11 devices, real-time and cloud-delivered protection on, tamper protection on, definitions updated automatically, managed in Intune. SmartScreen and network protection block malicious sites. Macs use XProtect with automatic security updates on."

If you use allow listing (A8.4 and A8.5)

Users must not be able to install unsigned applications or apps with invalid signatures. Phones, tablets and Chromebooks enforce this by default unless the device is jailbroken or rooted, or sideloading is allowed. You must also approve apps before they are deployed and keep a current list of approved apps. This includes personal devices used for work. MDM helps but is not required: a written approved app list, a policy and staff training can meet it.

A good answer: "Company iPhones are enrolled in Intune. Only apps from the App Store on our approved list are deployed. Staff phones under BYOD may only use Outlook, Teams and Authenticator for work, as set out in our BYOD policy, and must not be jailbroken or rooted."

Cloud services

For SaaS and much of PaaS, the provider protects the platform. Where you rely on that, be able to point to the provider's security documentation. For IaaS servers, you protect the virtual machines yourself.

What assessors typically query

• Option A only, with phones in scope and no mention of how they are covered.
• "Antivirus installed" with no product, update or real-time detail.
• No web protection described.
• No approved app list for allow listing.
• Servers not mentioned.

Answers that fail

• Any in-scope device with neither option active.
• Anti-malware switched off, out of date, or set to detect only.
• Users able to sideload unsigned apps on allow-listed devices.

Any non-compliant answer on a requirement fails the assessment.

Checklist

1. Map each device type to Option A, Option B, or both.
2. Confirm real-time protection, automatic updates and web protection are on.
3. Write and keep an approved app list for phones and tablets.
4. Block sideloading and jailbroken or rooted devices.

Read more in malware protection and mobile devices and support.