FFIEC IT Examination Handbook IS-II.C.12: II.C.12 Malware Mitigation (Information Security)

What does IS-II.C.12 require?

Management implements defence in depth to protect against, detect and respond to malware, considering hardware roots of trust, gateway execution of active content, blacklists and whitelists, port monitoring, network segregation, least-privilege configuration, application sandboxing, monitoring for and blocking of unauthorised software, monitoring for anomalous and polymorphic activity and network traffic, and user education in safe computing, indicators and response.