ISO 27001 Annex A 8.7 Protection against malware
What it says
Protection against malware shall be implemented and supported by appropriate user awareness.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement measures and train users to prevent and detect malware threats.
This control is all about stopping nasty software, like viruses or ransomware, from getting into your computer systems. If malware sneaks in, it could steal information, mess up your data, or even shut down important business operations, which could cost you time, money, and your hard-earned reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to prevent and detect malware (eg ransomware) can cause data theft, system outages and recovery costs, leading to regulatory and reputational harm.
How to implement
IT manager should ensure that malware detection software is installed and regularly updated on all computers and devices.
They can do this by setting automatic updates and conducting routine checks to verify that the software is working properly.
Human Resources and IT teams need to provide training to all employees on recognising and avoiding suspicious emails, links, and attachments.
This can be done through regular workshops and online modules that explain how to spot phishy emails and what steps to take if they suspect a malware attack.
Procurement should implement a policy that only allows authorised software to be used in the organisation.
This involves maintaining a list of approved software and requiring all new software acquisitions to pass through a review process to ensure it's safe to use.
The IT manager should set up rules that block access to known malicious websites and automatically scan downloaded files for malware.
This can be achieved by configuring network firewalls and browser settings to block dangerous sites and using web filters.
The Board should ensure a business continuity plan is in place for recovering from a malware attack.
This includes regular backups of critical data and systems, and practicing recovery procedures to make sure they're effective and staff are familiar with them.
Keep it running
Regularly update malware definitions and conduct frequent user training to stay ahead of evolving threats and social engineering tactics.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the malware protection policy and procedure documents.
Look at
Check if the documents outline the use of malware detection software and employee training on malware risks.
Good evidence
The documents clearly specify the types of malware protection used and outline training programs for staff.
- Check 2 of 5What an auditor asks for
Ask for
Ask for logs or reports from malware scanning software.
Look at
Verify that regular scans are conducted and any malware detected is addressed promptly.
Good evidence
Scan logs show consistent, automated scans with documented responses to any incidents.
- Check 3 of 5What an auditor asks for
Ask for
Request a list of authorised software.
Look at
Ensure the list is regularly updated and that there's a process for approving new software.
Good evidence
There's a documented, up-to-date list with a clear approval process for new software additions.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about the employee training schedule and materials on malware protection.
Look at
Review materials for clarity and comprehensiveness in teaching employees about malware threats.
Good evidence
Training materials are regularly updated and cover identifying threats and preventative actions comprehensively.
- Check 5 of 5What an auditor asks for
Ask for
Request to see the business continuity plan that includes malware scenarios.
Look at
Look for specific strategies for data recovery and system restoration after a malware attack.
Good evidence
The plan includes detailed recovery procedures and has been tested in routine drills or simulations.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.3, Web browsers block web ads from the internet, which this control covers in full and more.
ASD Essential Eight: 2 mappings
This control is broader than E8-AH-ML1.3.
Annex A 8.7 requires organisations to implement measures that protect against malware and to support them with user awareness. E8-AH-ML1.3 relates by requiring web browsers to block web ads from the internet, reducing malvertising-based malware delivery. E8-AH-ML1.3 is a specific hardening technique for a particular malware vector, while Annex A 8.7 is broader and covers multiple vectors and awareness.
This control is broader than E8-AH-ML2.3.
E8-AH-ML2.3 requires a specific technical restriction: Microsoft Office is blocked from creating executable content. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware more broadly (technical controls and user awareness). Implementing E8-AH-ML2.3 contributes to Annex A 8.7 as one concrete malware prevention mechanism, but Annex A 8.7 covers many additional measures beyond Office configuration.
ASD Information Security Manual: 25 mappings
This control is broader than ISM-0651.
Annex A 8.7 requires organisations to implement malware protection measures and reinforce them through user awareness. ISM-0651 relates by requiring content filtering to block files identified as malicious or that cannot be inspected, which directly prevents common malware delivery via email/web/file transfer. ISM-0651 is a specific gateway/filtering measure, while Annex A 8.7 is broader and includes endpoint controls, monitoring, response, and awareness.
This control is broader than ISM-0652.
Annex A 8.7 requires the implementation of controls to prevent and detect malware and to support those controls with user awareness. ISM-0652 relates by requiring suspicious files identified by content filtering to be quarantined until reviewed, which supports detection and containment of potential malware. ISM-0652 is limited to handling of suspicious files from filtering processes, whereas Annex A 8.7 covers broader organisational malware protection and awareness.
This control is broader than ISM-0657.
Annex A 8.7 requires implementing controls to protect against malware and ensuring users are aware of malware risks and behaviours. ISM-0657 relates by mandating scanning of data for malicious and active content before manual import, reducing the likelihood of introducing malware via removable media or transferred files. ISM-0657 is a specific preventative control for one ingestion pathway, whereas Annex A 8.7 covers broader malware protection and awareness across multiple vectors.
This control is broader than ISM-1034.
ISM-1034 requires a host-based intrusion prevention system (HIPS) or endpoint detection and response (EDR) solution on critical servers and high-value servers. These tools detect and block malicious code and behaviour on the host, making ISM-1034 a specific technical implementation of the protection against malware required by Annex A 8.7. Annex A 8.7 applies to all systems and also requires supporting user awareness, while ISM-1034 is limited to deploying HIPS or EDR on critical and high-value servers.
This control is broader than ISM-1234.
ISM-1234 requires organisations to implement email content filtering to detect and block potentially harmful content in email bodies and attachments. ISO/IEC 27001:2022 Annex A 8.7 requires implementing malware protection measures (with user awareness) to prevent, detect and recover from malware across the environment, which commonly includes email scanning/filtering as a key control. ISM-1234 is a specific, email-focused implementation, while Annex A 8.7 is broader and covers malware protections beyond email and includes an awareness component.
This control is broader than ISM-1287.
ISM-1287 requires that files imported or exported via gateways or cross domain solutions (CDSs) undergo content sanitisation to remove harmful or unsafe content. This supports Annex A 8.7 by providing a concrete preventative mechanism to reduce malware introduction via file transfer paths, particularly for externally sourced or cross-boundary files. Annex A 8.7 is broader and includes endpoint/network malware protections and awareness, while ISM-1287 is specific to sanitising files at transfer enforcement points.
This control is broader than ISM-1288.
ISM-1288 requires that files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines. This relates to Annex A 8.7, which requires organisations to implement protection against malware as a general control objective. ISM-1288 is a specific technical implementation pattern (multi-engine scanning at boundary transfer points), whereas Annex A 8.7 is broader and also includes non-gateway contexts and user awareness.
This control is broader than ISM-1289.
ISM-1289 requires archive files imported or exported via gateways or CDSs to be unpacked so the extracted contents can be content-filtered and inspected. This relates to Annex A 8.7 because unpacking and inspecting compressed containers at the boundary is a concrete malware-prevention measure that helps detect malicious payloads hidden inside archives. Annex A 8.7 is broader in scope, covering organisation-wide malware protection measures (e.g., endpoint protection, email/web filtering, user awareness) beyond gateway/CDS handling of archive formats.
This control is broader than ISM-1341.
ISM-1341 requires a Host-based Intrusion Prevention System (HIPS) or Endpoint Detection and Response (EDR) solution to be implemented on workstations to continuously detect and respond to threats. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware (typically including endpoint anti-malware controls and supporting awareness). HIPS/EDR is one way to implement endpoint malware/threat protection, but Annex A 8.7 is broader because it can include gateways, filtering, and user awareness beyond just workstation HIPS/EDR.
This control is broader than ISM-1389.
ISM-1389 requires executable files imported via gateways or CDSs to be automatically executed in a sandbox to detect suspicious behaviour. This implements a specific malware detection technique that supports the broader requirement in Annex A 8.7 to implement protection against malware. Annex A 8.7 also covers additional malware controls beyond sandboxing at ingest points.
This control is broader than ISM-1417.
ISM-1417 mandates detailed antivirus implementation requirements (signature and heuristic detection set high, reputation ratings, ransomware protection, daily updates, and regular disk/media scanning) across workstations and servers. Annex A 8.7 requires organizations to implement protection against malware (and support it with awareness), which is a broader outcome-focused requirement that can be met through multiple controls including antivirus, application control, and user training. ISM-1417 is one specific, prescriptive way of satisfying part of Annex A 8.7, but does not cover the awareness component or non-antivirus malware controls.
This control is broader than ISM-1486.
ISM-1486 requires that web browsers do not process Java from the internet as a measure to reduce web-borne code execution risk. ISO/IEC 27001:2022 Annex A 8.7 is broader, requiring organisations to implement protection against malware supported by awareness, which commonly includes hardening browsers and disabling risky active content such as Java. ISM-1486 is one specific technical control that can contribute to meeting the wider malware protection objective in Annex A 8.7.
This control is broader than ISM-1608.
ISM-1608 requires third-party standard operating environments (SOEs) to be scanned for malicious code and checked for unsafe/non-compliant configurations before use. This aligns with ISO/IEC 27001:2022 Annex A 8.7, which requires the organisation to implement malware protection controls across the environment, including controls that prevent malware introduction via externally sourced software or images. ISM-1608 is a specific supply-chain intake/checkpoint for malware assurance on third-party SOEs, while Annex A 8.7 is broader and also covers ongoing detection, response and user awareness beyond SOE ingestion.
This control is broader than ISM-1659.
ISM-1659 requires organisations to implement Microsoft's Vulnerable Driver Blocklist to reduce the chance malware or attackers can use vulnerable kernel drivers for privilege escalation or defence evasion. Annex A 8.7 requires implementing protection against malware, which can include hardening controls that prevent malicious components (including drivers) from running. Annex A 8.7 is broader and includes awareness and multiple malware controls, whereas ISM-1659 targets one specific driver-execution risk.
This control is broader than ISM-1672.
Annex A 8.7 requires organisations to implement protection against malware and reinforce it through user awareness. ISM-1672 supports malware protection by enabling antivirus scanning for Microsoft Office macros, directly addressing a malware vector at the application layer. ISM-1672 is a specific configuration requirement, while Annex A 8.7 is broader and includes other malware controls and awareness activities beyond macro scanning.
This control is broader than ISM-1782.
ISM-1782 requires using protective DNS to block access to known malicious domains, helping prevent users and systems from reaching malware delivery sites and command-and-control domains. ISO/IEC 27001:2022 Annex A 8.7 requires implementing protection against malware, which includes a range of preventive and detective measures across endpoints, email and networks. Protective DNS under ISM-1782 strengthens Annex A 8.7 by reducing inbound malware exposure, but it does not replace endpoint anti-malware controls and user awareness required by Annex A 8.7.
This control is broader than ISM-1890.
Annex A 8.7 requires organisations to implement protection against malware and support it with appropriate user awareness. ISM-1890 contributes to this by ensuring Microsoft Office macros are checked for malicious code before signing or use in Trusted Locations, reducing a common malware delivery mechanism. ISM-1890 is a specific technical control for macro hygiene, whereas Annex A 8.7 is broader and also expects wider malware controls (e.g. endpoint, email/web, response) and user awareness.
This control is broader than ISM-1969.
Annex A 8.7 requires implementing and supporting measures to prevent and detect malware, including user awareness. ISM-1969 relates by requiring malicious code to be treated in advance when stored or communicated so it cannot be accidentally executed, which is a preventative anti-malware handling practice. ISM-1969 is narrower and focuses on safe handling of suspected malicious code, while Annex A 8.7 covers the full organisational malware protection program and awareness.
This control is broader than ISM-2026.
ISM-2026 requires all software artefacts to be scanned for malicious content before they are imported into the authoritative software source. This relates directly to ISO/IEC 27001:2022 Annex A 8.7, which requires organisations to implement protection against malware, including measures such as scanning to prevent malicious code introduction. Annex A 8.7 is broader, covering organisation-wide anti-malware controls (e.g. endpoints, email, web, user awareness), while ISM-2026 is a specific supply-chain/gatekeeping control on software artefact ingestion.
This control is broader than ISM-2072.
ISM-2072 requires AI models to be stored in a non-executable file format that does not allow arbitrary code execution, so that loading a model cannot run embedded malicious code. This is a specific preventive measure against malicious code delivered through model files, which contributes directly to the protection against malware that Annex A 8.7 requires. Annex A 8.7 covers malware protection across all systems together with user awareness, while ISM-2072 addresses only the file format of AI models.
This control partially overlaps ISM-0917.
Annex A 8.7 requires organisations to implement protection against malware and support it with user awareness to help prevent and detect infections. ISM-0917 directly relates by specifying incident handling steps when malicious code is detected (isolation, scanning of media, removal, and restore/rebuild), which is part of an effective malware protection capability. ISM-0917 is focused on response and recovery procedures, while Annex A 8.7 also covers preventative and detection controls and explicitly includes user awareness.
This control partially overlaps ISM-1299.
ISM-1299 provides user precautions that reduce malware introduction on mobile devices, such as not using gifted/unauthorised peripherals, not connecting to public charging ports, and scanning removable media before use. This supports ISO/IEC 27001:2022 Annex A 8.7 by contributing to the 'appropriate user awareness' component of malware protection and reducing common infection vectors. Annex A 8.7 also requires technical malware controls, whereas ISM-1299 is primarily personnel awareness and behaviour for mobile devices and removable media.
This control partially overlaps ISM-1745.
ISM-1745 requires boot-time security controls including Early Launch Antimalware and secure/trusted/measured boot to reduce the chance of compromise during startup. Annex A 8.7 requires organisations to implement protection against malware, which includes but is not limited to antimalware measures across the endpoint lifecycle. They overlap where Early Launch Antimalware contributes to malware protection before other controls load, but Annex A 8.7 also covers user awareness and broader malware controls not addressed by ISM-1745.
This control supports ISM-1290.
ISM-1290 requires controlled unpacking of archive files to prevent malicious or pathological archives from reducing filter performance or causing unavailability. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware, and controlled unpacking strengthens malware protection by enabling safe inspection/scanning of archive contents while mitigating decompression-bomb denial-of-service risks. Annex A 8.7 is broader (all malware controls), whereas ISM-1290 is specifically about archive unpacking safeguards in the content filtering process.
This control depends on ISM-0263.
ISM-0263 requires decrypting and inspecting TLS traffic at gateways so that malicious payloads and unsafe content can be detected in encrypted sessions. Annex A 8.7 requires protection against malware; TLS inspection supports malware protection by enabling web and file scanning, URL filtering, and command-and-control detection that would otherwise be obscured by encryption. Annex A 8.7 covers a wider range of anti-malware controls across endpoints and systems, while ISM-0263 is focused on gateway enforcement for encrypted internet traffic.
ASD Essentials for enterprise IT: 5 mappings
This control is broader than IT.PRO-09.3.
IT.PRO-09.3 requires inbound content from external or untrusted sources to be inspected to prevent delivery of malicious or unsafe content. This is a specific preventive malware protection measure applied where content enters the organisation, directly contributing to Annex A 8.7. Annex A 8.7 is broader, covering malware protection across the environment and requiring it to be supported by user awareness.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsDepends on
This control depends on IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute on systems, with exceptions minimised and regularly reviewed. Application control of this kind is a strong preventive measure against malware, directly supporting Annex A 8.7 by stopping unauthorised executables from running. Annex A 8.7 is focused on malware and requires protection to be supported by user awareness, while IT.PRO-07.1 addresses software authorisation more broadly, including unsupported software.
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligenceDepends on
This control depends on IT.PRO-09.2.
IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked. This supports Annex A 8.7 by stopping systems from reaching malware distribution and command and control infrastructure, limiting both infection and the impact of any malware that does run. Annex A 8.7 covers malware protection more broadly and requires user awareness, while IT.PRO-09.2 is one network-level measure that also addresses threats other than malware.
This control depends on IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before they are granted access to organisational systems and data. Annex A 8.7 explicitly requires malware protection to be supported by appropriate user awareness, which this training provides where it covers threats such as malicious attachments and links. Annex A 8.7 centres on technical malware protection, while IT.PRO-14.1 covers awareness across all cyber security topics relevant to each role.
- IT.PRO-14.2Regularly update and deliver security awareness training as threats and operations changeDepends on
This control depends on IT.PRO-14.2.
IT.PRO-14.2 requires cyber security awareness training to be updated and delivered regularly to reflect current threats and operational considerations. Keeping training current maintains the user awareness that Annex A 8.7 requires to support malware protection, for example by covering new phishing and malicious attachment techniques. Annex A 8.7 centres on technical malware protection, while IT.PRO-14.2 addresses awareness training across all current threats.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.