In short: Cyber Essentials malware protection requires at least one active, up-to-date mechanism on every in-scope device. Windows and macOS devices can use anti-malware software that stops malware and malicious code running and blocks malicious websites. Any device can use application allow listing restricted by code signing. Sandboxing is not an option in v3.3.
What the malware protection control requires
Malware, including viruses, worms and ransomware, arrives through email attachments, downloads (app stores included) and unauthorised software installs. The control aims to stop known malware and untrusted software from running, causing damage or reaching your data. It applies to servers, desktops, laptops, tablets, phones and cloud services.
For every in-scope device you must use at least one of the two options below. Whichever you choose, it must be active, kept up to date in line with the vendor's instructions, and configured as the requirements describe. Most modern operating systems include one or both options; you can also use third-party products.
Option 1: anti-malware software
This option is available for in-scope devices running Windows or macOS, including servers, desktops and laptops. The software must be configured to:
- Update in line with the vendor's recommendations
- Prevent malware from running
- Prevent malicious code from executing
- Prevent connections to malicious websites over the internet
The last point is the one most often missed. Basic file scanning on its own is not enough; you need web protection too, whether built into the browser and operating system, provided by your endpoint product, or delivered by DNS filtering such as Cisco Umbrella. Microsoft Defender Antivirus, which ships with Windows, can meet the requirement when it is switched on, updating and paired with web protection. Business endpoint products such as Sophos Intercept X, Check Point Harmony Endpoint and Cisco Secure Endpoint add central management and reporting.
Option 2: application allow listing
This option is available for any in-scope device. Only approved applications, restricted by code signing, are allowed to run. You must:
- Actively approve applications before they are deployed to devices
- Keep a current list of approved applications
- Make sure users cannot install any application that is unsigned or has an invalid signature
The NCSC's own illustration pairs code signing with a rule that only vetted applications from the device's app store may run. Phones and tablets that can only install signed apps from the official store, with installation of unsigned apps blocked and jailbroken or rooted devices kept out, are the everyday example.
Which option fits which device
| Device type | Options available in v3.3 | Typical approach |
|---|---|---|
| Windows desktops, laptops and servers | Anti-malware or allow listing | Managed anti-malware with web protection |
| macOS desktops and laptops | Anti-malware or allow listing | Managed anti-malware with web protection |
| Linux servers and desktops | Allow listing (the anti-malware option is written for Windows and macOS) | Signed packages from approved repositories, with installs controlled |
| iPhones, iPads and Android devices | Allow listing | Signed apps from the official store only, managed through MDM |
| Cloud services | Shared with the provider | For SaaS the provider usually handles it; for IaaS you protect your own virtual machines |
User-owned phones and tablets that access organisational data are in scope too; see Cyber Essentials, BYOD and home working. Tools such as Sophos Mobile and Check Point Harmony Mobile help manage and protect mobile devices.
What happened to sandboxing?
Older versions of the requirements listed sandboxing, running applications in an isolated environment, as a third way to meet the control. It is not an option in v3.3. If your previous answers relied on it, you will need to show anti-malware or application allow listing instead. The Danzell question set page summarises the other recent changes.
How Cyber Essentials Plus tests malware protection
At Cyber Essentials Plus, test case 3 checks malware protection on sampled end-user devices, servers with a user-interactive desktop and infrastructure-as-a-service instances. For devices using anti-malware software, the assessor first confirms it is installed and running, then either uses harmless test files to check defences against malware delivered by email (sub-test 3.1.1) and through the browser (3.1.2), or carries out manual checks of the protection (3.1.3), depending on the product. Devices that rely on certificate-based application allow listing have their own sub-test (3.2).
The email test is why email security matters as well as endpoint protection: products such as Sophos Email or Check Point Harmony Email and Collaboration catch malicious attachments before they reach a user. Staff awareness also helps; see phishing simulation.
How we help
We check that every in-scope device has an active, updating mechanism configured to the four anti-malware points or to allow listing, close gaps in web and email protection, and report coverage centrally so nothing slips. If you need new tools, we can supply endpoint, DNS and email protection; ask us for a quote.
Contact us to review your malware protection, or go back to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft Defender enough for Cyber Essentials?
It can be. The requirements accept protection built into the operating system, as long as it is active, kept up to date, stops malware and malicious code running, and blocks connections to malicious websites. Check the web protection part is switched on.
Do phones need antivirus for Cyber Essentials?
Not necessarily. In v3.3 the anti-malware option is written for Windows and macOS devices. Phones and tablets usually meet the control through application allow listing: only signed apps from the official store can be installed.
Is sandboxing still acceptable for Cyber Essentials?
No. Sandboxing appeared in older versions of the requirements but is not one of the options in v3.3. Use anti-malware software or application allow listing restricted by code signing.
Do servers need malware protection for Cyber Essentials?
Yes. Servers are explicitly covered by the malware protection control. Servers running Windows or macOS can use anti-malware software; servers on other operating systems, such as Linux, need application allow listing.
Does anti-malware have to block websites for Cyber Essentials?
Yes. If you rely on anti-malware software, it must prevent connections to malicious websites as well as stopping malware and malicious code from running. DNS filtering or browser protection often provides this.