Malware protection
Protecting devices from malicious software, via anti-malware and/or only allowing approved applications to run.
🔍 What a scan can verify
Endpoint anti-malware is essentially invisible to an external website scan — we can verify almost nothing here.
📝 What stays self-declared
Whether anti-malware is active on every device, and whether app allow-listing or sandboxing is used, is entirely self-declared — a CE Plus assessor checks this on your actual devices.
What Cyber Essentials asks for this control
- Is anti-malware protection active on all in-scope devices (or do you only allow approved applications to run)?
Either approach is accepted: anti-malware that's kept updated, OR application allow-listing.
- Are unapproved applications prevented from running, and downloads/attachments handled safely?
E.g. blocking unsigned/unknown apps, and not auto-running content from email or the web.
How to get ready
- Make sure reputable, auto-updating anti-malware is running on every device — or use application allow-listing instead.
- Prevent unapproved software from running, and don't auto-open downloads or attachments.
Check your malware protection — and the other four controls
Answer the Cyber Essentials questions in plain English and get a per-control readiness verdict — free, no login needed, and we don't store your answers.
Start the free readiness check →← Back to all five Cyber Essentials controls.
This is a free readiness / gap report to help you prepare — it is not a certification, and we are not an IASME Certification Body. To certify, you apply through an accredited Certification Body.