Protection against malware

What the control asks

Malware protection is to be implemented and backed by appropriate user awareness. Purpose: protect information and associated assets from malware. Guidance: protection combines detection and repair software with awareness, suitable system access and change controls, since detection software alone is rarely enough. Consider: measures that stop or spot unapproved software, such as application allowlisting (8.19, 8.32); controls that prevent or detect visits to sites known or suspected to be malicious, such as blocklists; reducing vulnerabilities malware could exploit through vulnerability management (8.8, 8.19); regular automated validation of system software and data, especially for critical processes, investigating unapproved files or changes; protections against risks from obtaining files and software from or through external networks or other media; installing and keeping updated detection and repair software that scans computers and media, including scanning data received over networks or on media before use, scanning email and messaging attachments and downloads before use at several points such as mail servers, desktops and the network boundary, and scanning web pages when accessed; placing and configuring tools according to risk assessment, applying defence in depth (for example at network gateways for email, file transfer and web, and on endpoints and servers) and accounting for evasion such as encrypted files or encrypted transport; guarding against malware introduced during maintenance and emergency procedures that bypass normal controls; a process to authorize temporary or permanent disabling of protections, with approval authorities, documented justification and a review date; continuity arrangements for recovery after a malware attack with online and offline backups and recovery measures (8.13); isolating environments where outcomes could be catastrophic; procedures and responsibilities for malware protection, including training, reporting and recovery; awareness and training for all users on recognizing and limiting infected emails, files and programs (6.3); regularly gathering information on new malware from mailing lists or relevant sites; and checking that malware warnings come from qualified, reputable sources and are accurate. Other information: some systems such as certain industrial control systems cannot run anti-malware software, and some malware infects operating systems and firmware so deeply that a full reimage, sometimes including firmware, is needed.

Purpose in the standard’s terms, in our words: Ensures information and associated assets are protected against malware.

Attribute values in one line: Preventive, Detective, Corrective; Confidentiality, Integrity, Availability; Protect, Detect; System and network security, Information protection; Protection, Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Anti-malware deployment and update status reports across endpoints, servers and gateways
• Application allowlisting and malicious website blocking configurations
• Email, download and web scanning configuration at gateways and endpoints, including handling of encrypted content
• Approved exception records for disabled protections with justification, approver and review date
• Malware recovery plans with offline backups and evidence of restore testing
• User awareness material on malware and records of threat information sources monitored

Where audits commonly find gaps

• Anti-malware is deployed but signature updates fail silently on some hosts
• Protections are disabled for performance without a recorded exception or review date
• Backups are online only and would be encrypted by ransomware
• Systems that cannot run anti-malware, such as industrial controllers, have no compensating isolation

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, detective, corrective), so the register should record each and the evidence that proves each one operates. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (12.2.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 8.20 Networks security
• 8.30 Outsourced development
• 5.37 Documented operating procedures

Read the five attributes All 93 controls