NIST SP 800-167 Guide to Application Whitelisting 3.3b: Scan for malware and secure the host before installing the whitelisting agent

What does 3.3b require?

Before whitelisting software goes onto a host, the host is scanned for malware and either cleaned or rebuilt so that no malicious file is captured in whitelist generation, and its operating system is confirmed properly secured, fully patched and carrying the other required security controls, because a weak host undermines the protection whitelisting provides.