Malware protection

Malware protection stops known malware and untrusted software from running and causing damage. Requirements v3.3 says a malware protection mechanism must be active on every device in scope, using at least one of two options: anti-malware software, or application allow listing. Whichever you use must be active, kept up to date as the vendor instructs, and configured as the requirements describe.

Where malware comes from

Typical routes are email attachments, downloads (including from app stores) and people installing unauthorised software. You reduce the risk by stopping malware reaching devices and stopping it from running if it does.

The control applies to servers, desktops, laptops, tablets, phones, and IaaS, PaaS and SaaS services. For SaaS and most PaaS, the provider normally protects the platform. See the cloud shared responsibility model.

Option 1: anti-malware software

Version 3.3 lists this as the option for in-scope devices running Windows or macOS, including servers, desktops and laptops. Apexward also requires it on Linux; see below. If you use it, it must be set to:

• update in line with the vendor's recommendations,
• prevent malware from running,
• prevent malicious code from executing, and
• prevent connections to malicious websites over the internet.

You do not need to buy a product. IASME's malware FAQ confirms that the protection built into the operating system, Microsoft Defender on Windows and XProtect on macOS, can meet the requirement when it is switched on and updating. For the website blocking part, Defender's web protection or SmartScreen, or a DNS or web filter, can do the job.

Option 2: application allow listing

This option is available for any in-scope device. Only approved applications, restricted by code signing, may run. You must:

• approve each application before it is deployed to devices,
• keep a current list of approved applications, and
• make sure users cannot install any application that is unsigned or has an invalid signature.

Phones and tablets usually meet the control this way. iOS and iPadOS only run signed apps from the App Store. On Android, keep installs to the Google Play Store and block sideloading of apps from unknown sources, ideally through mobile device management. Approving apps can be as simple as an MDM-managed list, or a rule that staff may only install apps from the official store for work use.

Linux computers and servers

Requirements v3.3 describes the anti-malware option for Windows and macOS. Apexward, as a Certification Body, requires anti-malware software on Linux computers and servers as well. ClamAV with on-demand scanning meets this requirement, provided its signatures are kept up to date. If another Certification Body marks your assessment, check how it treats Linux devices.

Common problems

• A third-party antivirus trial has expired, which can also leave the built-in protection turned off.
• Real-time protection has been disabled to fix a performance issue and never turned back on.
• Android phones allow apps from unknown sources.
• Jailbroken or rooted devices, which defeat code signing.
• Servers excluded from anti-malware because "they are only servers".

What to do

1. List each device type and decide which option it uses.
2. On Windows and Mac computers and servers, confirm Defender or your chosen product is on, updating and using real-time protection. On Linux, install anti-malware such as ClamAV and keep its signatures updating.
3. Turn on web protection or a DNS filter so known malicious sites are blocked.
4. On phones and tablets, restrict installs to the official store and block unknown sources through MDM where you can.
5. Keep a simple list of approved applications if you use allow listing.
6. Check centrally, through your security console or MDM, that no device is unprotected.

The readiness checker asks which option each device type uses and checks the settings that go with it.