OPS-04 Protection Against Malware - Concept
Maintain approved and communicated malware protection policies stating which system specific protection mechanisms apply, how protection programs run on production components the provider is responsible for, and how they
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Endpoint management (MDM / EDR)
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Approved malware protection policy with version history and approval signature · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Distribution evidence showing the policy reached operations and end user support staff · Policy repository / GRC workspace
- Inventory of system classes mapped to the protection mechanism selected for each · Policy repository / GRC workspace
- Management console hardening standard referenced by the policy · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Endpoint management (MDM / EDR)); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Policy covers office endpoints yet says nothing about production servers or container images
- No stated mechanism for systems that cannot run a resident scanner
- Policy approved years ago and untouched since the platform moved to containers
- Management consoles treated as outside the scope of malware controls
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-03 Capacity Management - Controlling of Resources · OPS-05 Protection Against Malware - Implementation