Malware protection

Every device in scope needs protection against malware, using at least one of three approved approaches.

The three approaches

• Anti-malware software: installed, kept up to date, configured to scan files automatically on access and on download, and set to prevent connections to known malicious websites.
• Application allow-listing: only pre-approved applications are permitted to run, everything else is blocked by default, so unknown or malicious software simply can't execute.
• Application sandboxing: applications, particularly ones handling untrusted content like a web browser, run in an isolated environment so that even if compromised, they can't affect the rest of the device.

Anti-malware software is the most common and familiar approach, but the other two are valid alternatives, and some organisations combine more than one for defence in depth.