Malware protection is the fourth control. The scheme requires every in-scope device to run a malware protection mechanism — anti-virus, application allow-listing, sandboxing, or a combination — that scans in real-time and updates signatures or detection rules at least daily.
Every in-scope device must run a malware protection mechanism configured to scan files on access and on download.
Signature-based anti-virus must update at least daily.
Application allow-listing or sandboxing is an acceptable alternative to signature-based AV where it is appropriately deployed.
The malware protection must be configured to prevent users from running unsigned software where practical.
Web browsers and email clients must block known phishing and malicious-content sites.
Samples in-scope devices to confirm the malware protection is enabled and definitions are current (within 24 hours).
Verifies real-time scanning is on; confirms scheduled scans run regularly.
Checks browser configuration for SmartScreen / Safe Browsing / equivalent.
On firms using application allow-listing instead of AV, reviews the allow-list scope and exception process.
Across CE Plus engagements, the following gaps recur on this control. None require deep architectural change. Most are operational discipline that drifted between annual assessments.
Windows Defender disabled on developer laptops because the dev team installed a third-party AV that was later uninstalled, leaving the device unprotected.
Definitions out of date because the device has not synced for several weeks (laptop in a drawer, then put back in service).
Browser SmartScreen / Safe Browsing disabled by group policy from a previous IT admin who thought it leaked browsing data to Microsoft / Google.
Email gateway scanning configured but not actually filtering anything because the policy was set to permissive when troubleshooting and never tightened.
Boundary firewalls and personal firewalls block unauthorised inbound traffic and restrict outbound connections to known-good destinations.
Devices and software are configured to remove or disable unused services, change default passwords, and apply secure baseline settings.
Access to data and services is controlled through individual accounts with appropriate privileges, and administrative privileges are tightly restricted.
All software is kept up-to-date and patches for high-severity and critical vulnerabilities are applied within 14 days of vendor release.