Key takeaways
- Protect against malware with technology and user awareness.
- Malware remains one of the most common causes of incidents.
- Start here: deploy anti-malware or endpoint detection on all endpoints and servers.
Purpose
Protect against malware with technology and user awareness.
Requirement
Requirement summaryProtection against malware shall be implemented and supported by appropriate user awareness.
Why it matters
Malware remains one of the most common causes of incidents.
How to implement
- Deploy anti-malware or endpoint detection on all endpoints and servers.
- Keep signatures and engines updated automatically.
- Filter email and web traffic.
- Train users to spot malicious content.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.7. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your malware protection policy.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.7 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A report showing malware protection is installed, switched on and up to date on all devices and servers.
- Records of malware detections and how they were handled.
- Awareness material warning staff about malware.
Things you should be able to show or explain
- Be able to show the protection settings.
How much to show: 10 or so devices and servers.
Common mistakes
- Protection switched off on some devices.
- Detections not looked into.
- Endpoint protection disabled by users.
- Servers left unprotected because 'Linux does not get viruses'.
- Tip: EDR plus training on suspicious attachments.
Policies & documents to have
- Operations Security Policy
- Information Security Policy
FAQ
Is A.8.7 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.7?
Be ready to explain how the control works in your organisation and to provide things like: Your malware protection policy…