Protection against malware

Plain-language summary

Defending systems and information against viruses, ransomware and other malicious code through layered technical measures — endpoint protection, email and web filtering, control over what software can run — backed by users who recognise and report what gets through.

What the clause is really asking

Ransomware is the malware that ends businesses, and the Information Regulator has shown what it expects. Its first POPIA fine, R5 million against the Department of Justice and Constitutional Development, followed a ransomware attack in which the department's antivirus and intrusion-detection licences had been allowed to lapse, and its failure to put that right when ordered to. The control asks for protection that is more than an installed product: preventing unauthorised software, blocking known malicious websites and attachments, keeping detection and response software current on every endpoint and server, scanning files arriving by email, download and removable media, reducing the vulnerabilities malware exploits, and having a recovery plan for when it gets through. The awareness part is explicit: users must know how malware arrives, especially through phishing, and how to report it. The common misunderstanding is 'we have antivirus, so we comply'. Auditors want to see coverage, currency and alerting, and they want to know that someone acts when an alert fires.

What auditors look for

Auditors ask for the endpoint protection console and compare the number of protected devices with the asset inventory, looking for servers and laptops that are missing, out of date or reporting errors. They check the licence expiry date. They ask to see email and web filtering settings and the quarantine report. They pick a recent detection and trace it: who was alerted, what was done, was it logged as an event or incident? They ask how users report a suspicious email and look for awareness or phishing-simulation records. The hard question: if the protection on a server stopped updating tomorrow, who would know, and how quickly?

Typical evidence

Malware protection policy or standard; endpoint protection console reports showing coverage, versions and health; licence and subscription renewal dates; email and web filtering configuration and quarantine reports; application control or software restriction settings; detection alerts with response records; awareness training and phishing-simulation records; malware outbreak recovery procedure.

How to comply — recommendations

Reconcile the endpoint protection console against the asset inventory monthly — every laptop, desktop and server, including the forgotten machines on the shop floor or in the warehouse — and chase anything missing or unhealthy. Put licence and subscription renewal dates in the risk owner's diary with a 60-day reminder; a lapsed licence is an avoidable finding and, as the Regulator showed, an avoidable fine. Turn on attachment sandboxing and link scanning, block macros in files from the internet, and stop ordinary users installing software. Route detection alerts to a person or the MSP's service desk with an agreed response time. Run short phishing awareness sessions and provide a simple report-phishing button. Write a one-page malware response procedure tied to your incident and backup plans.

Common nonconformities

Endpoint protection missing from some servers or devices; protection licences or subscriptions expired; agents or signatures out of date; detection alerts going unreviewed; users able to install software freely; no filtering of email attachments and links; no malware awareness or phishing training; no recovery procedure for a malware outbreak; detections not recorded as security events.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.