CIS Control 10 Malware Defenses Guide

Most organisations have anti-malware installed almost everywhere, yet fail CIS Control 10 because they cannot prove it is on every capable asset, correctly configured, updating and impossible for an attacker to switch off. CIS Control 10 (Malware Defenses) in CIS Controls v8.1 covers anti-malware deployment, signature updates, removable media, anti-exploitation features, central management and behaviour-based detection. This guide explains its seven Safeguards by Implementation Group, an implementation sequence with audit and pilot stages, the evidence and measures assessors use, and how the Control maps to NIST, ISO and ATT&CK. It is for endpoint and security operations teams and GRC staff preparing for a CIS assessment. For malware families, infection chains and analysis, see the Malware Guide; this page stays on what Control 10 requires and how to show it is met.

Key takeaways

IG1 is three Safeguards. Deploying anti-malware on all enterprise assets (10.1), automatic signature updates (10.2) and disabling autorun and autoplay for removable media (10.3) apply to every organisation.
IG2 adds depth, not just tools. Removable media scanning (10.4), anti-exploitation features (10.5), central management (10.6) and behaviour-based anti-malware (10.7) start at IG2, and IG3 adds nothing further.
Coverage is measured against the inventory. The CIS assessment specification counts capable assets from the Control 1 inventory and reports those with authorised, unauthorised or no anti-malware, so an unmanaged laptop or server shows up as a failure.
"Properly configured" is part of the test. Installed but misconfigured agents (real-time protection off, broad exclusions, stale signatures) are counted separately and do not meet 10.1 or 10.2.
The agent and its console are privileged identities. Anti-malware runs with system rights everywhere and its management console can change policy on every endpoint, so tamper protection and control of console admin roles are part of meeting Control 10.

What it is and who it applies to

CIS states the purpose of Control 10 as preventing or controlling the installation, spread and execution of malicious applications, code or scripts on enterprise assets. The Safeguards are all about devices: workstations, laptops, servers and, where the platform supports it, mobile devices. Cloud workloads and containers are enterprise assets too, so they count wherever an agent or platform equivalent can run.

IG1: CIS describes IG1 as essential cyber hygiene. For Control 10 it means 10.1 to 10.3. A small organisation can meet IG1 with the anti-malware built into its operating systems (Microsoft Defender Antivirus on Windows, XProtect and Gatekeeper on macOS), managed through its endpoint management tool, plus a policy that disables autorun.
IG2: adds 10.4 to 10.7. In practice this means a centrally managed product with behavioural detection, usually an EDR or next-generation antivirus platform, and a baseline of exploit mitigations enforced by configuration management.
IG3: has no additional Control 10 Safeguards. The difference at IG3 is rigour: application allowlisting under Control 2 (Safeguards 2.5 to 2.7), tighter exclusion governance and integration with network monitoring in Control 13.

CIS Controls v8.1 (2024) revised asset classes, added a Govern security function, realigned mappings to NIST CSF 2.0 and clarified some Safeguard descriptions. Safeguard numbers and titles for Control 10 match v8, and the IG assignments and measures on this page come from the v8 CIS Controls Assessment Specification. Take asset class and security function values from the v8.1 download if you report them formally.

Structure and key requirements

Safeguard	Title	IG	Function (v8)	What it requires
10.1	Deploy and Maintain Anti-Malware Software	IG1, IG2, IG3	Protect	Anti-malware deployed and maintained on all enterprise assets
10.2	Configure Automatic Anti-Malware Signature Updates	IG1, IG2, IG3	Protect	Automatic updates of signature files on all enterprise assets
10.3	Disable Autorun and Autoplay for Removable Media	IG1, IG2, IG3	Protect	Autorun, autoplay and auto-execute disabled for removable media
10.4	Configure Automatic Anti-Malware Scanning of Removable Media	IG2, IG3	Detect	Anti-malware scans removable media automatically when connected
10.5	Enable Anti-Exploitation Features	IG2, IG3	Protect	Anti-exploitation features enabled where possible, such as Data Execution Prevention (DEP), Windows Defender Exploit Guard, Apple System Integrity Protection (SIP) and Gatekeeper
10.6	Centrally Manage Anti-Malware Software	IG2, IG3	Protect	Anti-malware managed from a central console or service
10.7	Use Behavior-Based Anti-Malware Software	IG2, IG3	Detect	Anti-malware that detects on behaviour, not only on signatures

What each Safeguard means in practice

10.1 "authorised" anti-malware: the assessment specification checks assets against the authorised software inventory from Control 2. An asset running only an unapproved product (a leftover trial, a personal licence) is counted separately from one with nothing, and neither passes. Define the authorised products per platform in your configuration standard (Safeguard 4.1).
10.2 signatures, and more: the Safeguard names signature files, but modern products also update engines and platform components. On Windows, event 2001 records a failed security intelligence update and event 2003 a failed engine update; both are worth collecting.
10.3 autorun: on Windows, set the "Turn off AutoPlay" and "Disallow Autoplay for non-volume devices" Group Policy settings or the equivalent Intune settings. Under the hood, Microsoft documents the NoDriveTypeAutoRun value in Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, where bit 0x04 covers removable drives; administrators usually set 0xFF to cover all drive types. See the Removable Media and USB Control Guide.
10.4 removable media scanning: enable scanning of removable drives on access and, where the product supports it, on mount. Pair it with the ASR rule "Block untrusted and unsigned processes that run from USB", which Microsoft notes stops execution from the drive but not copying files from it.
10.5 anti-exploitation: on Windows this means DEP, the Exploit protection system settings (control flow guard, mandatory ASLR, SEHOP), attack surface reduction (ASR) rules and, where hardware allows, memory integrity. On macOS keep SIP enabled and Gatekeeper set to allow only App Store and identified developers. See the Windows Endpoint Hardening Guide.
10.6 central management: the measure is the share of authorised anti-malware products that are centrally managed. A product that only reports locally, or a server estate managed by hand, fails.
10.7 behaviour-based: the product must detect on what code does (process injection, credential access, mass file encryption) rather than only on known hashes. Most EDR and NGAV platforms meet this; plain signature AV does not. See the Next-Generation Antivirus (NGAV) Guide and the EDR Guide.

Choosing a product approach

Approach	Safeguards it covers	Fits	Gaps to plan for
Built-in OS protection, locally configured	10.1, 10.2, 10.3 (with policy)	Very small IG1 organisations	No central evidence; fails 10.6; weak against tampering
Built-in OS protection managed by MDM or GPO	10.1 to 10.6; 10.7 depends on platform features enabled	IG1 and lean IG2 estates	Detection and response workflow is thin; macOS and Linux coverage varies
NGAV platform	10.1 to 10.7	IG2 without a 24x7 SOC	Limited investigation telemetry
EDR or XDR platform	10.1 to 10.7, plus telemetry for Controls 8 and 13	IG2 and IG3 with a SOC or managed detection service	Needs tuning and exclusion governance; console access is high privilege
Application allowlisting (WDAC, AppLocker)	Complements 10.5 and 10.7; belongs to Control 2	Servers, kiosks, high-risk IG3 users	Operational effort; does not replace anti-malware for 10.1

For servers, containers and Linux hosts, check that the chosen product has a supported agent for each operating system build in the inventory before you count them as covered. See the EDR and XDR Buyer's Guide and the Application Allowlisting Guide.

Identity and NHI requirements

Control 10 has no identity Safeguard of its own, but three identity issues decide whether the Safeguards hold under attack.

Console and policy admins: whoever can edit the central policy (10.6) can add exclusions, switch rules to audit or uninstall the agent across the estate. Put console roles under Control 5 and 6 discipline: named accounts, phishing-resistant MFA, separate roles for viewing, tuning and policy publishing, and alerting on policy changes. See the Privileged Access Management Guide.
Tamper protection and local admin: attackers with local administrator rights try to disable real-time protection or add exclusions; ATT&CK tracks this as T1685 Disable or Modify Tools. Microsoft Defender tamper protection blocks changes to real-time protection, behaviour monitoring, cloud protection, security intelligence updates and antivirus exclusions, and ignores Group Policy changes to those settings. Removing standing local admin rights (Control 5) closes the most common path. In the Storm-0501 hybrid cloud attacks, the ransomware affiliate tampered with security products after gaining privileged access, which is why tamper protection and console control matter as much as detection.
Agent and integration credentials: EDR platforms use enrolment tokens, API clients for SIEM and SOAR integration, and cloud connectors with read access to tenants. These are non-human identities with estate-wide reach. Store them in a vault, scope API clients to the actions they need (read alerts, not isolate hosts, unless the playbook requires it) and rotate them on a schedule. See the Service Account Security Guide.

When malware is an infostealer, the response is a credential incident as well as an endpoint one: revoke sessions and rotate any keys, tokens and passwords that were on the device. See the Infostealer Threat Guide.

Implementation steps

Baseline coverage: export the Control 1 asset inventory and the anti-malware console's device list, and reconcile them. Classify every asset as authorised product installed, unauthorised product only, or none (the 10.1 measures). Unknown devices in the console and inventory assets missing from it are both findings.
Write the configuration standard: under Safeguard 4.1, record per platform the authorised product, real-time protection settings, update source and frequency, removable media scanning, cloud protection level, tamper protection and the exclusion policy (who approves, maximum duration, review date). See the EDR Tuning and Exclusions Management Guide.
Deploy and centralise (10.1, 10.6): push the agent through endpoint management to a pilot ring (IT and security staff), then broad rings. Remove or migrate unauthorised products. Bring servers and cloud workloads into the same console.
Turn on updates and IG1 hardening (10.2, 10.3): enforce automatic signature and engine updates and the autorun policy for all assets. Verify with a sample of devices that the last update time is within a day.
Add removable media scanning and exploit mitigations (10.4, 10.5): apply the settings in audit mode first where the product offers it. For ASR rules, run each rule in audit mode for two to four weeks, review audited events (event 1122 on Windows, or the ...Audited action types in advanced hunting), create narrow per-rule exclusions, then move to block. Exploit protection settings that break legacy applications should get a per-application override, not a global rollback.
Enable behavioural detection (10.7): switch on behaviour monitoring, cloud-delivered protection and, where available, ransomware-specific protection. Start in detect-only for automated remediation on servers if the operations team needs confidence first.
Lock it down: enable tamper protection, restrict console roles, and route events to the SIEM under Control 8. See the CIS Control 8 Audit Log Management Guide.
Plan rollback: keep the ability to switch an individual rule back to audit, to pause a policy for one ring, and to use the product's troubleshooting mode for a single device. Record every rollback as a change with an end date.

Small versus large organisations

Small (IG1): use the built-in protection, manage it from your device management tool so you have one report of coverage and update status, and disable autorun in the same policy. That is enough for 10.1 to 10.3 and gives most of 10.6.
Large (IG2/IG3): the hard problems are drift and exceptions. Measure coverage weekly against the inventory, keep exclusions in a register with owners and expiry dates, and test that tamper protection holds after major platform updates. A managed detection service is often the practical way to make 10.7 detections actionable around the clock.

Evidence and assessment

The CIS Controls Assessment Specification measures Control 10 as counts of assets that are capable, covered and properly configured, so evidence is mostly reports from the management console reconciled with the inventory.

Safeguard	Evidence an assessor expects	Measure to report
10.1	Authorised product list per platform; console device report reconciled with the asset inventory; configuration standard	Capable assets with authorised anti-malware, with unauthorised only, and with none; properly versus improperly configured
10.2	Update policy; report of last signature update per device	Assets configured to update signatures automatically versus capable assets
10.3	GPO, Intune or MDM profile disabling autorun and autoplay; compliance report	Assets with autorun, autoplay and auto-execute disabled versus capable assets
10.4	Policy showing removable media scanning enabled	Assets configured to scan removable media versus capable assets
10.5	Exploit protection and ASR policies; mode per rule; per-application overrides	Assets with anti-exploitation features enabled versus all inventoried assets
10.6	Console screenshots or exports showing managed devices and policy assignment	Authorised anti-malware products centrally managed versus total authorised products
10.7	Product documentation or settings showing behaviour monitoring enabled	Assets with behaviour-based anti-malware installed and properly configured versus capable assets

Events to collect

Source	Event	Why it matters
Windows Defender Operational log	1116 malware detected; 1117 action taken	Detections and whether remediation succeeded
Windows Defender Operational log	2001 security intelligence update failed; 2003 engine update failed	Evidence for 10.2 gaps
Windows Defender Operational log	5001 real-time protection disabled; 5010 and 5012 scanning disabled; 3002 real-time protection feature failure	Protection switched off, by fault or by an attacker
Windows Defender Operational log	5007 configuration changed	Unexpected exclusions or rule changes; Microsoft advises reviewing unexpected 5007 events as possible malware activity
Windows Defender Operational log	1121 ASR block; 1122 ASR audit	ASR rule effect during audit and after enforcement
Management console	Tamper alerts, policy changes, agent uninstall, devices not seen	Attempts to disable defences and coverage drift

Metrics that show it is working

Coverage: percentage of capable inventoried assets with an authorised, healthy, centrally managed agent seen in the last seven days.
Update currency: percentage of assets with signatures less than 24 hours old.
Protection-off time: count of 5001 or tamper events per month and median time to restore protection.
Exclusion hygiene: number of active exclusions, and the share past their review date.
ASR enforcement: percentage of assets with the agreed ASR rules in block mode rather than audit.
Detection outcome: percentage of 1116 detections with a successful 1117 remediation, and median time to triage high-severity behavioural alerts.

Mapping to other frameworks

Safeguards	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022 Annex A	ATT&CK techniques reduced
10.1, 10.2, 10.6	PR.PS-05, DE.CM-09	SI-3, SI-3(4)	A.8.7 Protection against malware	T1204 User Execution
10.3, 10.4	PR.PS-05	MP-7, CM-7, SI-3	A.7.10 Storage media; A.8.7	T1091 Replication Through Removable Media
10.5	PR.PS-01, PR.PS-05	SI-16, CM-7	A.8.7; A.8.9 Configuration management	T1203 Exploitation for Client Execution; T1068 Exploitation for Privilege Escalation
10.7	DE.CM-09	SI-3, SI-3(8), SI-4	A.8.7; A.8.16 Monitoring activities	T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact
Tamper resistance (supporting)	PR.PS-01	SI-3, CM-5	A.8.7	T1685 Disable or Modify Tools

NIST SP 800-83 Rev. 1, the Guide to Malware Incident Prevention and Handling for Desktops and Laptops, is the long-standing companion for writing the prevention and handling procedures behind these Safeguards. The joint CISA and MS-ISAC #StopRansomware Guide recommends automatic updates for antivirus and anti-malware, a centrally managed solution that escalates warnings to security staff, and application allowlisting or EDR on all assets, which lines up with 10.2, 10.6 and 10.7. CIS publishes official v8.1 mappings; use those for formal crosswalks.

Common pitfalls

Counting the console, not the estate: coverage reported as a percentage of devices the console knows about always looks high. Report against the asset inventory, and treat inventory assets the console has never seen as 10.1 failures.
Exclusions that become blind spots: whole-folder or whole-process exclusions added for performance stay forever and are a known attacker hiding place. Require a ticket, an owner and an expiry for each one.
ASR rules left in audit: audit mode was meant to be a few weeks; a year later nothing blocks. Track the share of rules in block as a metric.
No tamper protection, standing local admin: an attacker or a frustrated user with admin rights turns protection off and nobody notices. Enable tamper protection, alert on 5001 and 5007, and remove local admin under Control 5. The Storm-0501 intrusions show privileged attackers do go after security products.
Servers and Linux treated as out of scope: 10.1 covers all enterprise assets. File servers, hypervisors where supported and Linux hosts often run with no agent or an unmanaged one.
Detections closed without credential follow-up: an infostealer quarantined on a laptop has usually already sent its haul. Add session revocation and secret rotation to the malware playbook. See the Malware Outbreak Playbook.

Practitioner checklist

Confirm the target IG: IG1 needs 10.1 to 10.3; IG2 and IG3 need all seven Safeguards.
Name the authorised anti-malware products per platform in the software inventory and configuration standard.
Reconcile console device lists with the asset inventory every week and chase both directions of mismatch.
Enforce automatic signature and engine updates and alert on update failures (2001, 2003).
Disable autorun and autoplay, scan removable media on connection and block unsigned execution from USB.
Roll out exploit protection and ASR rules through audit, pilot and block, with per-rule exclusions and a rollback path.
Manage every agent centrally, with behaviour monitoring and cloud protection enabled.
Turn on tamper protection, restrict console roles with phishing-resistant MFA and alert on policy changes.
Vault and scope EDR API clients and enrolment tokens like any other privileged non-human identity.
Report coverage, update currency, protection-off events and exclusion age to the risk owner monthly.

CIS Control 10 Malware Defenses Guide: Safeguards, Implementation Groups and Evidence