ISO 27001:2022
Technological controls – ISO 27001:2022

ISO 27001:2022 8.7: Protection against malware

Malware protection is to be implemented and backed by appropriate user awareness. Purpose (stated in ISO/IEC 27002:2022): ensures information and associated assets are protected against malware. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.7.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 118 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 17 controls

  • CIS-1.2 Address Unauthorized Assets
  • CIS-10.1 Deploy and Maintain Anti-Malware Software
  • CIS-10.2 Configure Automatic Anti-Malware Signature Updates
  • CIS-10.3 Disable Autorun and Autoplay for Removable Media
  • CIS-10.4 Configure Automatic Anti-Malware Scanning of Removable Media
  • CIS-10.5 Enable Anti-Exploitation Features
  • CIS-10.6 Centrally Manage Anti-Malware Software
  • CIS-10.7 Use Behavior-Based Anti-Malware Software
  • CIS-13.5 Manage Access Control for Remote Assets
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution
  • CIS-14.1 Establish and Maintain a Security Awareness Program
  • CIS-2.3 Address Unauthorized Software
  • CIS-2.7 Allowlist Authorized Scripts
  • CIS-9.2 Use DNS Filtering Services
  • CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
  • CIS-9.6 Block Unnecessary File Types
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections

PCI DSS 4.0 · 15 controls

  • 1.5.1 1.5.1 Security controls on dual-connected devices
  • 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic
  • 11.5.1.1 11.5.1.1 Service providers detect covert malware channels
  • 12.10.5 12.10.5 Plan covers alerts from security monitoring systems
  • 5.2.3.1 5.2.3.1 Targeted risk analysis sets evaluation frequency
  • 5.3.5 5.3.5 Users cannot disable or alter anti-malware
  • 5.4.1 5.4.1 Mechanisms detect and protect against phishing
  • 6.4.2 6.4.2 Automated web attack detection and prevention
  • 5.2.1 5.2.1 Anti-malware deployed on all system components
  • 5.2.2 5.2.2 Anti-malware detects and handles all known malware
  • 5.2.3 5.2.3 Periodic evaluation of components not at risk from malware
  • 5.3.1 5.3.1 Anti-malware kept current through automatic updates
  • 5.3.2 5.3.2 Periodic and real-time scans or continuous behavioural analysis
  • 5.3.3 5.3.3 Anti-malware covers removable electronic media
  • 6.4.3 6.4.3 Payment page script management

FedRAMP High · 12 controls

  • CM-11 User-Installed Software
  • CM-7(2) Prevent Program Execution
  • CM-7(5) Authorized Software Allow-by-Exception
  • CM-8(3) Automated Unauthorized Component Detection
  • MA-3(2) Maintenance Tools | Inspect Media (MA-3(2))
  • SC-18 Mobile Code
  • SC-7(12) Boundary Protection | Host-based Protection (SC-7(12))
  • SI-3 Malicious Code Protection
  • SI-7 Software, Firmware, and Information Integrity
  • SI-8 Spam Protection
  • SI-8(2) Spam Protection | Automatic Updates (SI-8(2))
  • SR-10 Inspection of Systems or Components (SR-10)

FedRAMP Moderate · 12 controls

  • CM-11 User-Installed Software
  • CM-7(2) Prevent Program Execution
  • CM-7(5) Authorized Software Allow-by-Exception
  • CM-8(3) Automated Unauthorized Component Detection
  • MA-3(2) Maintenance Tools | Inspect Media (MA-3(2))
  • SC-18 Mobile Code
  • SC-7(12) Boundary Protection | Host-based Protection (SC-7(12))
  • SI-3 Malicious Code Protection
  • SI-7 Software, Firmware, and Information Integrity
  • SI-8 Spam Protection
  • SI-8(2) Spam Protection | Automatic Updates (SI-8(2))
  • SR-10 Inspection of Systems or Components (SR-10)

ASD Strategies to Mitigate Cyber Security Incidents · 7 controls

  • ASD37-01 Application control (Essential)
  • ASD37-03 Configure Microsoft Office macro settings (Essential)
  • ASD37-05 Automated dynamic analysis of email and web content (Excellent)
  • ASD37-06 Email content filtering (Excellent)
  • ASD37-12 Antivirus software with heuristics (Very Good)
  • ASD37-15 User education (Limited)
  • ASD37-16 Antivirus software with signatures (Limited)

CMMC 2.0 · 7 controls

NIST SP 800-53 Rev 5 · 5 controls

Azure Security Benchmark · 4 controls

  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASBv3-ES-3 Ensure anti-malware software and signatures are updated
  • ES-1 Use Endpoint Detection and Response (EDR)
  • ES-2 Use modern anti-malware software

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented
  • NIST-CSF-RS.MI-02 Incidents are eradicated

UK Cyber Essentials · 4 controls

  • CE-MP.1 Anti-Malware Software Deployed
  • CE-MP.2 Anti-Malware Signatures Updated
  • CE-MP.3 Anti-Malware Scans Files on Access and Web Pages
  • CE-MP.4 Application Allowlisting (Alternative)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

NIST SP 800-171 Rev 3 · 3 controls

SOC 2 · 3 controls

  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary
  • SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software

ACSC Essential Eight · 2 controls

  • E8-APP-ML1 Application Control (ML1)
  • E8-MACRO-ML1 Configure Microsoft Office Macro Settings (ML1)

C5 (Germany) · 2 controls

  • C5-OPS-04 Protection Against Malware - Concept
  • C5-OPS-05 Protection Against Malware - Implementation

COBIT 2019 · 2 controls

  • DSS05.01 DSS05.01 Protect against malicious software
  • DSS05.03 DSS05.03 Manage endpoint security

HIPAA Security Rule · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

AWS Well-Architected Security Pillar · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-5 Limit, prevent, detect and remove malware

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

DORA · 1 control

ISO 27001:2013 · 1 control

ISO 27002:2022 · 1 control

  • 8.7 Protection against malware

ISO 27701:2019 · 1 control

  • 6.9.2 Protection from malware

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-172 · 1 control

  • 3.4.2e Automated Detection and Remediation of Unauthorized Software

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technological controls – ISO 27001:2022

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 8.7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold ISO 27001:201383.9% covered · 15 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 118 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27001:2022 controls