What evidence do auditors commonly ask for on 8.7 Protection against malware?

Anti-malware deployment and update status reports across endpoints, servers and gateways; Application allowlisting and malicious website blocking configurations; Email, download and web scanning configuration at gateways and endpoints, including handling of encrypted content; Approved exception records for disabled protections with justification, approver and review date; Malware recovery plans with offline backups and evidence of restore testing; User awareness material on malware and records of threat information sources monitored.

What is the most common gap auditors find on 8.7?

Anti-malware is deployed but signature updates fail silently on some hosts

ISO/IEC 27002:2022 · Technological controls

`8.7` Protection against malware

Malware protection is to be implemented and backed by appropriate user awareness. Purpose: protect information and associated assets from malware. Guidance: protection combines detection and repair software with awareness, suitable system access and change controls, since detection software alone is rarely enough. Consider: measures that stop or spot unapproved software, such as application allowlisting (8.19, 8.32); controls that prevent or detect visits to sites known or suspected to be malicious, such as blocklists; reducing vulnerabilities malware could exploit through vulnerability management (8.8, 8.19); regular automated validation of system software and data, especially for critical processes, investigating unapproved files or changes; protections against risks from obtaining files and software from or through external networks or other media; installing and keeping updated detection and repair software that scans computers and media, including scanning data received over networks or on media before use, scanning email and messaging attachments and downloads before use at several points such as mail servers, desktops and the network boundary, and scanning web pages when accessed; placing and configuring tools according to risk assessment, applying defence in depth (for example at network gateways for email, file transfer and web, and on endpoints and servers) and accounting for evasion such as encrypted files or encrypted transport; guarding against malware introduced during maintenance and emergency procedures that bypass normal controls; a process to authorize temporary or permanent disabling of protections, with approval authorities, documented justification and a review date; continuity arrangements for recovery after a malware attack with online and offline backups and recovery measures (8.13); isolating environments where outcomes could be catastrophic; procedures and responsibilities for malware protection, including training, reporting and recovery; awareness and training for all users on recognizing and limiting infected emails, files and programs (6.3); regularly gathering information on new malware from mailing lists or relevant sites; and checking that malware warnings come from qualified, reputable sources and are accurate. Other information: some systems such as certain industrial control systems cannot run anti-malware software, and some malware infects operating systems and firmware so deeply that a full reimage, sometimes including firmware, is needed.

Source: ISO/IEC 27002:2022, 8.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

easy

to go live

Endpoint management (MDM / EDR)

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Anti-malware deployment and update status reports across endpoints, servers and gateways · Endpoint management (MDM / EDR)
Application allowlisting and malicious website blocking configurations · Endpoint management (MDM / EDR)
Email, download and web scanning configuration at gateways and endpoints, including handling of encrypted content · Vulnerability scanner / patch tooling

periodic reviewEvidence produced at each review

Approved exception records for disabled protections with justification, approver and review date · Endpoint management (MDM / EDR)

governing documentDocuments that govern the control

Malware recovery plans with offline backups and evidence of restore testing · Policy repository / GRC workspace
User awareness material on malware and records of threat information sources monitored · HR system / LMS

First move

Automate the pull from your Endpoint management (MDM / EDR). Device compliance report from the MDM (encryption, EDR agent, OS version) on a daily pull.

Common gaps auditors find

Anti-malware is deployed but signature updates fail silently on some hosts
Protections are disabled for performance without a recorded exception or review date
Backups are online only and would be encrypted by ransomware
Systems that cannot run anti-malware, such as industrial controllers, have no compensating isolation

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

8.6 Capacity management · 8.8 Management of technical vulnerabilities