CyberEssentials 101: Malware Protection June 6, 2025 – Posted in: Cyber Security – Tags: Cyber Essentials, Cyber Essentials 101, Cyber Security, CyberEssentials, cybersecurity, it support, ITSupport, SmallBusiness
Malware, such as viruses, is generally used to steal or destroy information. It’s often delivered via phishing attacks – obtaining information by confidence trickery, or social network sites which can be mined for information useful to a hacker to provide a focussed attack on an organisation. Anti-malware solutions (including anti-virus) are available from commercial suppliers, some free, but usually as complete software and support packages.
Malware is continually evolving, so it is important that the supplier includes detection facilities which are updated as frequently as possible. Anti-malware products can also help confirm whether websites you visit are malicious.
Questions in this section apply to: servers, desktop computers, laptops, thin clients, tablets, mobile phones, and cloud based software services.
Further guidance can be found here.
A8.1 – Are all of your desktop computers, laptops, tablets and mobile phones protected from malwarE.
Why are they asking you this?
Malware protection is vital for any device with internet access.
What’s the detail?
Please note – if you use smartphones and standard laptops you’ll need to select both option A and B.
Example answer:
1. Having anti-malware software installed
and/or
2. Limiting installation of applications by application allow listing (For example, using an app store and a list of approved applications, using a Mobile Device Management)
and/or
3. None of the above, please describe
A8.2 – If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor’s guidelines and prevent malware from running on detection?
Why are they asking you this?
An antivirus that hasn’t been set up properly only grants a false sense of security. Your anti-malware software should always be configured as recommended.
What’s the detail?
You can use any commonly used anti-virus product, whether free or paid-for as long as it can meet the requirements in this question. Windows Defender is suitable for this purpose.
Example answer:
In order to pass the answer to this question must be yes.
A8.3 – If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?
Why are they asking you this?
Prevention is better than cure! Keeping users away from known malicious websites to prevent malware from being downloaded in the first place is safer than waiting to try to catch it as it tries to install.
What’s the detail?
Your anti-malware software or internet browser should be configured to prevent access to known malicious websites. On Windows 10, SmartScreen can provide this functionality.
Example answer:
In order to pass the answer to this question must be yes.
A8.4 – If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?
Why are they asking you this?
Unsigned applications are highly risky as there is no way to make sure that they are what they say they are.
What’s the detail?
Some operating systems which include Windows S, Chromebooks, mobile phones and tablets restrict you from installing unsigned applications. Usually you have to “root” or “jailbreak” a device to allow unsigned applications.
Example answer:
In order to pass the answer to this question must be yes.
A8.5 – If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?
Why are they asking you this?
Maintaining a list of approved apps lets you make sure nothing risky is being installed.
What’s the detail?
You must create a list of approved applications and ensure users only install these applications on their devices. This includes employee-owned devices. You may use mobile device management (MDM) software to meet this requirement but you are not required to use MDM software if you can meet the requirements using good policy, processes and training of staff.
Example answer:
In order to pass the answer to this question must be yes.
Next Time…
Next week we will post the full White Paper on Cyber Essentials.
If you’d like help reviewing what you’d need to do to be compliant, filling in the paperwork, or working with your staff to smooth any required changes, we can help. Give us a call on 01245 265 100 or email .