ISO 27001 A.8.7: Protection Against Malware

ISO 27001 A.8.7 requires that protection against malware is implemented and backed by appropriate user awareness across every system that runs code. It is a Technological control (A.8), and teams most often get flagged on the gap between an endpoint tool that runs on most devices and the coverage evidence, allowlisting, and awareness training that prove the control operates everywhere it should.

What is ISO 27001 A.8.7?

A.8.7 Protection against malware governs how an organization defends its systems against malicious software and reinforces those defenses with user awareness. In the words of ISO/IEC 27001:2022, Annex A, the control title is Protection against malware. The intent, as described in ISO/IEC 27001:2022, Annex A, is that protection against malware is implemented on the organization's systems and supported by appropriate user awareness, so that malicious code is prevented, detected, and responded to before it can compromise information.

Malware protection under A.8.7 spans the whole path code can take into an environment: the endpoints and servers that run software, the email and web channels that deliver it, the downloads and removable media that carry it, and the people whose actions open the door. The control is technology-neutral. It does not name an anti-malware vendor or mandate a specific scanning engine. What it asks is that malware defenses are deployed, kept current, and combined with awareness rather than treated as a one-time install.

How do you implement A.8.7?

Implement A.8.7 by layering technical detection across every system that runs code with user awareness that reduces the human openings, then evidencing that the layers stay current:

1. Deploy anti-malware or EDR on endpoints and servers. Put a detection agent, for example CrowdStrike Falcon or Microsoft Defender for Endpoint, on every in-scope endpoint and server, beyond the knowledge-worker laptops. Servers, build agents, and engineering workstations are the systems teams most often leave uncovered.
2. Keep detection current. Signatures, behavioral models, and agent versions update automatically, and a coverage report confirms every in-scope host is reporting and up to date. Stale or missing agents are the most common finding.
3. Control software installation. Restrict who can install software, and where the maturity exists, enforce allowlisting so only approved applications run. This narrows what malware can execute in the first place and ties to A.8.19 installation of software on operational systems.
4. Scan email, web, and downloads. Filter malicious attachments and links at the email gateway, scan web traffic and downloads, and inspect removable media so malicious code is caught at the delivery channel before it reaches an endpoint.
5. Isolate and respond to detections. When a detection fires, the host is isolated, the event is triaged, and the response is recorded. Detection without a response path leaves the control incomplete.
6. Combine with user awareness training. Reinforce the technical controls with awareness training that teaches people to recognize phishing, suspicious attachments, and unexpected downloads. A.8.7 names user awareness as part of the control itself, which is why it pairs with A.6.3 security awareness training.

In cloud environments

Cloud and workload environments implement A.8.7 through managed detection and image-level controls rather than a single endpoint agent on a physical box:

• Managed EDR on cloud workloads and endpoints provides behavioral detection, continuous telemetry, and host isolation across instances, containers, and managed devices, with the coverage report drawn from the provider or EDR console.
• Container image scanning in the pipeline inspects images for known-malicious and vulnerable components before they deploy, so malware is caught at build time rather than at runtime.
• Hardened, managed base images come with a minimal software footprint and the detection agent baked in, so every workload launched from the image inherits protection by default.
• Email and web filtering through managed services scans attachments, links, and downloads at the provider layer for cloud-hosted mail and browsing.
• Restricted deployment and installation through pipeline controls and image immutability limits what runs in production to approved, scanned artifacts.

On-prem / self-hosted

On-prem environments reach the same outcomes with endpoint and gateway tooling that produces its own evidence. The SOC 2 endpoint security on-prem guide covers the full endpoint implementation; the shape is:

• Endpoint AV or EDR on every laptop, desktop, and server, with built-in OS protection as the floor and a behavioral EDR platform where the program has the maturity to run one.
• Gateway scanning at the email and web perimeter, filtering malicious attachments and links before they reach an endpoint, plus removable media scanning where USB use is permitted.
• Application allowlisting on servers and fixed-function endpoints, where a narrow, known set of approved software runs and everything else is blocked.
• Local update and coverage management confirming every host runs a current agent, reported through the endpoint management console rather than assumed.

Cloud vs on-prem at a glance

What evidence demonstrates A.8.7?

Evidence for A.8.7 is paired: a configuration artifact showing malware protection is deployed, plus a coverage or response record showing it operates across the estate and that awareness backs it. Many teams generate the coverage report continuously by wiring the EDR console into an evidence pipeline, the approach covered in GRC engineering.

A common gap that comes up during readiness work is a malware control that looks complete on paper but has silent coverage holes, often on the systems teams assume are already covered. One team evaluating endpoint strategy considered running employees entirely through virtual desktop infrastructure to avoid managing devices, on the assumption that VDI would take the physical endpoints out of scope. Examining the conditional access requirements showed the opposite: the platform still needed to verify each connecting device before granting access, and that verification depended on an endpoint agent checking anti-malware, encryption, and patch status on the device itself. VDI shifted the endpoint control obligation without removing it. The team deployed lightweight endpoint management directly, with anti-malware among the enforced policies, in under a week, which produced cleaner coverage evidence than the VDI evaluation had taken to run. The fix in these cases is a coverage report that reconciles every in-scope host against the anti-malware console, so the systems nobody remembered to enroll show up as gaps before an auditor finds them.

How does A.8.7 map to SOC 2?

A.8.7 is a Full overlap with SOC 2 CC6.8. Organizations with an existing SOC 2 program can reuse the same malware protection evidence for the ISO 27001 certification audit with no adaptation.

Both A.8.7 and CC6.8 address the prevention and detection of unauthorized and malicious software, so the anti-malware configuration, EDR coverage report, allowlisting settings, and pipeline scanning results produced for one framework carry into the other. The SOC 2 to ISO 27001 control mapping covers the full crosswalk and where SOC 2 work transfers to ISO 27001.

Related controls

A.8.7 protects against malicious code, and it leans on the controls that define what devices and software it runs on. A.8.1 user endpoint devices governs the security of the endpoints that malware protection is deployed onto, so the two are read together but address different obligations: A.8.1 is the device baseline, A.8.7 is the malicious-code defense on it. A.6.3 security awareness, education and training delivers the user awareness that A.8.7 requires as its human layer. A.8.19 installation of software on operational systems controls what software may be installed, which is the allowlisting side of malware prevention, and A.8.23 web filtering restricts access to malicious sites that deliver it. The ISO 27001 certification guide is the hub for how these controls fit into a full ISMS.

Part of Truvo's control-by-control ISO 27001 Annex A reference series. Start from the ISO 27001 certification guide for the full picture. If you are implementing A.8.7 as part of an effective security program and want a second set of eyes on the coverage and evidence, Truvo runs scoping calls.

Frequently Asked Questions

What is ISO 27001 A.8.7?

ISO 27001 A.8.7 Protection against malware is a Technological control in Annex A of ISO/IEC 27001:2022. It requires that protection against malicious software is implemented across the organization's systems and reinforced by appropriate user awareness. It covers anti-malware and EDR on endpoints and servers, current detection, software installation control, scanning of email, web, and downloads, isolation and response to detections, and awareness training.

What evidence satisfies A.8.7?

A.8.7 evidence is paired: a configuration artifact plus a coverage or response record. Auditors expect an EDR or anti-malware coverage report showing every in-scope host is protected, the agent and signature configuration, detection and response logs with triage records, software installation or allowlisting configuration, email and web filtering configuration and logs, and security awareness training records. The coverage report is what demonstrates the control reaches the whole estate rather than most of it.

How do you implement A.8.7 in the cloud versus on-prem?

Cloud implementations use managed EDR across instances and containers, container image scanning in the pipeline, hardened base images with the agent pre-installed, and managed email and web filtering. On-prem implementations reach the same outcomes with endpoint AV or EDR on every device and server, email and web gateway scanning, application allowlisting, and coverage reporting through the endpoint management console. The controls are equivalent; the evidence looks different.

Is A.8.7 a new control in ISO 27001:2022?

No. A.8.7 is not new to the 2022 revision. Protection against malware carried over from the 2013 version of the standard, where it appeared as the malware control in the operations security family. The 2022 revision reorganized Annex A into four themes and placed it under the Technological controls as A.8.7, but the control itself is not new.

Does VDI remove the endpoint malware protection requirement?

No. Moving users onto virtual desktop infrastructure shifts the endpoint control obligation without removing it. Conditional access still needs to verify the connecting device before granting access, and that verification depends on an endpoint agent checking anti-malware, encryption, and patch status on the physical device. The connecting endpoint stays in scope for A.8.7, so it still needs malware protection and coverage evidence.

How does A.8.7 map to SOC 2 CC6.8?

A.8.7 maps to SOC 2 CC6.8 as a Full overlap. Both address the prevention and detection of unauthorized and malicious software. Evidence produced for CC6.8, including anti-malware and EDR configurations, coverage reports, software installation restrictions, container and CI/CD scanning results, and detection and response logs, is reusable for the ISO 27001 A.8.7 requirement without adaptation.