Requirement
The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives.
Points of Focus
Restricts Installation and Modification of Application and Software
Requirement: The ability to install and modify applications and software is restricted to authorized individuals. Utility software capable of bypassing normal operating or security procedures is limited to use by authorized individuals and is monitored regularly.
Detects Unauthorized Changes to Software and Configuration Parameters
Requirement: Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software.
Uses a Defined Change Control Process
Requirement: A management-defined change control process is used for the implementation of software.
Uses Antivirus and Anti-Malware Software
Requirement: Antivirus and anti-malware software on servers and endpoint devices is configured, implemented, and maintained to provide for the interception or detection and remediation of malware.
Scans Information Assets From Outside the Entity for Malware and Other Unauthorized Software
Requirement: Procedures are in place to scan information assets that have been transferred or returned to the entity’s custody for malware and other unauthorized software. Detected malware or other software is removed prior to connection to the entity’s network.
Explanation
Malicious or unapproved software is a leading cause of breaches, so the entity must both block it and spot it quickly. Auditors review who can install software, how unauthorized changes are detected, whether antivirus tooling is maintained, and how incoming devices and files are scanned before joining the network.
