ASD ISM 1417 Ensure antivirus protection on workstations and servers
What it says
An antivirus application is implemented on workstations and servers with: - signature-based detection functionality enabled and set to a high level - heuristic-based detection functionality enabled and set to a high level - reputation rating functionality enabled - ransomware protection functionality enabled - detection signatures configured to update at least daily - regular scanning configured for all fixed disks and removable media.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall antivirus software on all computers and servers to detect and prevent malware and ransomware.
This control ensures that all computers and servers have antivirus software to protect against viruses and ransomware. Without it, malware can disrupt operations, steal data, or cause financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without antivirus protection, computers risk malware infections that can cripple operations, leading to data theft and financial harm.
How to implement
IT teams should install antivirus software on all company computers and servers.
Find a reliable vendor and follow their guidelines to complete the installation on each device.
System owners should work with IT to configure antivirus settings.
Ensure virus signature updates are automatic and happen every day to catch new threats.
Managers should verify that heuristic detection features are active.
Heuristic detection helps catch unknown viruses by identifying suspicious behaviour.
IT staff should enable reputation rating and ransomware protection in the antivirus settings.
This helps in blocking malicious software based on known bad behaviour and sources.
IT teams should schedule regular scans on all devices.
Set up weekly scans to check all internal drives and any external media like USB sticks.
Keep it running
Regularly check that antivirus protections are updated and scans are conducted on schedule to maintain security effectiveness.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the antivirus software inventory list.
Look at
whether each workstation and server is included.
Good evidence
All devices are listed with antivirus software version.
- Check 2 of 5What an auditor asks for
Good evidence
Daily updates with no interruptions longer than 24 hours.
- Check 3 of 5What an auditor asks for
Ask for
to see the configuration settings of antivirus programs. Check if heuristic and reputation-based detections are enabled.
Good evidence
Settings are enabled and active.
- Check 4 of 5What an auditor asks for
Look at
regular scans and their frequency.
Good evidence
Logs show weekly scans with detailed results.
- Check 5 of 5What an auditor asks for
Ask for
incident reports related to antivirus detections. Examine the response actions taken and their timeliness.
Good evidence
Timely responses with resolved cases.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1417 mandates detailed antivirus implementation requirements (signature and heuristic detection set high, reputation ratings, ransomware protection, daily updates, and regular disk/media scanning) across workstations and servers. Annex A 8.7 requires organizations to implement protection against malware (and support it with awareness), which is a broader outcome-focused requirement that can be met through multiple controls including antivirus, application control, and user training. ISM-1417 is one specific, prescriptive way of satisfying part of Annex A 8.7, but does not cover the awareness component or non-antivirus malware controls.
ASD Essential Eight: 1 mapping
This control supports E8-RM-ML1.3.
ISM-1417 requires comprehensive antivirus on workstations and servers, including high-level detection settings, daily signature updates, ransomware protection, and regular scanning of fixed and removable media. E8-RM-ML1.3 specifically requires enabling antivirus scanning for Microsoft Office macros, which is a concrete malware detection use case that would typically be delivered via the endpoint antivirus capability mandated by ISM-1417. ISM-1417 is broader because it covers whole-of-system antivirus configuration and scanning beyond Office macro content.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.