Control A.8.7Protection against malware
Protection against malware must be implemented and supported by appropriate user awareness.
The control pairs technical protection with awareness, and the pairing is deliberate: detection handles what is known, and people handle the rest.
The technical side has broadened well past signature scanning — behavioural detection, endpoint response tooling, application control, and the isolation of what cannot be trusted. What matters for the control is that the protection covers the paths malware actually arrives by: email, web, removable media, software installation and the supply chain.
Coverage is where audits find the gaps. Servers, build agents, network appliances and non-Windows endpoints are frequently outside the arrangement that covers laptops, and each is a place a foothold survives.
Ransomware is the case that ties this control to others: prevention here, backups under A.8.13, segregation under A.8.22, recovery under A.5.30. An organisation relying on prevention alone has one control between it and a total loss.
How to put this in place
Malware reaches organisations through email, web and removable devices, and one infection can spread widely. Your ISMS needs layered protection that covers every device and server, plus proof someone watches the alerts.
- Decide the scope: every endpoint and server, with any exclusions justified in writing.
- Deploy endpoint protection with central alerting and automatic updates.
- Filter email attachments and links, and restrict who can install software.
- Train staff to spot and report suspicious emails, links and files.
- Assign someone to triage alerts and record how they were handled.
- Compare protection coverage with the device inventory on a schedule.
Evidence an auditor usually looks for: endpoint protection coverage reports, email filtering settings, training records, and alerts with how they were handled.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.