Malware Protection Policy

1. Purpose

This policy reduces the chance and effect of malicious software, including viruses, worms, ransomware, spyware, trojans, rootkits, malicious scripts and malicious documents, reaching the Organisation's systems and information. It combines technical controls, user behaviour and a tested response.

2. Scope

The policy applies to all devices that connect to the Organisation's networks or process its information: servers, workstations, laptops, mobile devices, virtual machines, containers, cloud workloads and appliances, whether owned by the Organisation or by the user under an approved arrangement.

• In scope: employees, contractors, visitors with network access and suppliers who connect to Organisation systems.
• Out of scope: operational technology and appliances that cannot run protection software; these are handled by network isolation and recorded as exceptions with compensating controls.

3. Terms and Definitions

4. Roles and Responsibilities

5. Policy Statements

5.1 Protection against malware

1. Every in-scope device must run current, centrally managed malware protection before it joins the network. Devices without it must be refused network access or placed in a quarantine network.
2. Protection must include real-time scanning, behavioural detection, ransomware protection and, for Tier 1 servers and all laptops, EDR with central logging.
3. Users must not disable, uninstall or alter protection. Only the endpoint administrator may change settings, and tamper protection must be turned on.
4. Only software from the approved software list may be installed. Administrator rights on endpoints are removed from ordinary users; software that is not on the list needs approval by the information security manager.
5. Software and files downloaded from external sources must be scanned before use. Executable and script content in email attachments from outside the Organisation must be blocked or sandboxed.
6. Removable media is blocked by default. Where allowed, it must be scanned at every connection and encrypted when it holds Confidential data.
7. Web filtering must block categories known to deliver malware, newly registered domains and sites with poor reputation, as the Acceptable Usage Policy describes.
8. Macros in documents from outside the Organisation are disabled by default; signed macros from approved publishers may run.

5.2 Malware protection software

• The tool must be supported by its supplier and updated with new versions within [30 days] of release. End-of-life tools must be replaced under the Change Management Policy and Procedure.
• Scanning exclusions must be requested through a ticket, justified, approved by the information security manager, recorded in the exclusion register and reviewed [every 6 months].
• The management console must be protected with multi-factor authentication, and the people who can uninstall agents or change policy are named in the access review.
• Operating systems and applications must be patched under the Patch Management Policy, since malware often uses known vulnerabilities.

5.3 User awareness and reporting

• All staff must complete awareness training on phishing, malicious attachments, fake updates and removable media at induction and at least every [12 months].
• Simulated phishing exercises are run at least [quarterly]. Results are used for training and not for punishment unless a person repeatedly ignores training or conceals an incident.
• Users must report suspected malware or suspicious messages at once through the report button or the service desk, and must not try to clean a device themselves.

5.4 Response to a malware event

1. Detect and reportA detection, user report or alert reaches security operations. Target: triage within [15 minutes] for EDR high-severity alerts.
2. ContainIsolate the device from the network using EDR or the switch port, disable affected accounts, block malicious addresses and hashes. Target: within [30 minutes] of confirmation.
3. AssessDetermine malware type, entry route, systems and data affected, and whether other devices are involved. Decide if the event is an incident, and follow the Information Security Incident Management Policy.
4. Eradicate and recoverReimage affected devices from a trusted build; restore data from clean backups; reset credentials that may be exposed.
5. ReportWhere the event is a reportable cyber incident, report it within [6 hours] of noticing it as required by the CERT-In Directions of 28 April 2022 [confirm the current requirement]. Notify customers and authorities according to the incident procedure.
6. LearnRecord cause, timeline and actions; update rules, awareness material and baselines.

6. Severity Guide

7. Compliance and Monitoring

• The endpoint administrator reports coverage and health of agents weekly; devices that do not meet the target are fixed or disconnected.
• The information security manager reviews detections, exclusions and user-reported cases monthly, and reports trends to the information security forum each [quarter].
• Detection and response capability is tested at least [once a year] with a safe test file, a simulated phishing campaign and a response exercise.

8. Measures

9. Records and Evidence

• Agent coverage and health reports, kept [12 months].
• Detection and incident records and containment actions, kept [3 years].
• Exclusion register and approvals, kept while current plus [2 years].
• Awareness completion and simulation results, kept [3 years].

Annexure A: Malware event record

10. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

11. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

12. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Acceptable Usage Policy
• Patch Management Policy
• Information Security Incident Management Policy
• Logging and Monitoring Policy
• Secure Configuration Policy
• Mobile Device and Teleworking Policy
• Backup and Restoration Policy