Malware Protection Policy Template: Prevention, Detection and Response Rules You Can Adopt

Many organisations have anti-malware software everywhere and a malware protection policy nowhere, so nobody owns the exclusion list, servers and cloud storage go unscanned, and the agent that was switched off "temporarily" during an upgrade stays off. The ISO/IEC 27001:2022 Annex A control on protection against malware expects protection supported by user awareness, not software alone. This template is the governing document for that control. It covers prevention of delivery and execution, detection coverage across endpoints, servers, email, web and cloud storage, exclusions and temporary disablement, updates, awareness, and the link to backup and incident response. It is written for CISOs, endpoint and infrastructure owners and policy owners. Device-level settings live in the Endpoint Hardening Checklist; this policy sets the rules those settings implement.

How to use this template

• Replace text in square brackets, such as [Organisation], [CISO] and [24 hours], with your own terms and values. Bracketed values are suggested defaults, not external requirements.
• "Must" indicates a mandatory requirement. "Should" indicates a recommended practice where a documented exception may be justified.
• Keep product names, scan schedules and the exclusion list in a separately versioned malware protection standard so they can change without re-approving the policy.
• Response steps for an active infection are in the Malware Outbreak Playbook; this policy only requires that one exists and is used.
• Place this policy beneath your Information Security Policy Template.

1. Purpose

This policy sets the requirements for protecting [Organisation]'s systems, data and users against malicious software, including viruses, worms, ransomware, trojans, malicious scripts and macros, and potentially unwanted programs. Its aims are to stop malware being delivered, stop it running if delivered, detect and contain it quickly when it runs, and recover without paying attackers.

2. Scope

This policy applies to:

• All end-user devices owned or managed by [Organisation], including laptops, desktops and mobile devices, and personal devices used under the BYOD Policy Template.
• Servers, virtual machines, containers and virtual desktop infrastructure, on premises and in the cloud.
• Email, web and file transfer gateways, and cloud storage and collaboration services that hold [Organisation] files.
• Removable media and files received from third parties.
• Operational technology and specialised systems, with the adjustments in section 4.7.
• All employees, contractors and third parties who use or administer these systems.

3. Roles and responsibilities

4. Policy statements

4.1 Preventing delivery

1. Inbound email must be scanned for malware, with executable and script attachment types blocked as listed in the malware protection standard. See the Email Security Policy Template.
2. Web traffic from managed devices must be filtered to block known malicious and newly registered high-risk domains, using DNS or web filtering.
3. Files uploaded to or synchronised with cloud storage and collaboration services must be scanned where the platform supports it.
4. Remote Desktop Protocol and other remote access must not be exposed to the internet. Remote access must use [the approved gateway] with multi-factor authentication. See the Remote Access Policy Template.
5. Internet-facing systems and remote access devices must be patched as the Patch Management Policy Template requires, with known exploited vulnerabilities fixed within [14 days] or sooner.
6. Autorun for removable media must be disabled. Removable media must be scanned on connection.

4.2 Preventing execution

1. Users must not install software that is not on [the approved software list] or available from [the company software portal].
2. Application control must allow only approved applications on [high-risk systems, servers and privileged workstations], and should be extended to all endpoints. See the Application Allowlisting Guide.
3. Office macros from the internet must be blocked. Macros must run only where signed by a trusted publisher or approved for a business need.
4. Scripting environments must be constrained where supported, for example PowerShell Constrained Language Mode enforced by an application control policy.
5. Users must not hold local administrator rights for daily work. Administrators must not use privileged accounts for email or web browsing.
6. Host firewalls must block inbound connections by default.

4.3 Detection coverage

1. Every asset in [the asset inventory] that supports protection must report to the central console. Assets that do not report for [7 days] must be investigated.
2. Anti-malware engines and signatures must update automatically at least [daily]. Agents more than [one version] behind must be updated.
3. Tamper protection must be enabled so users and local processes cannot disable the agent.
4. Detections must alert [Security operations] centrally. High-severity detections must be triaged within [1 hour].

4.4 Exclusions and temporary disablement

1. Scan exclusions must be requested through [the exclusion process], stating the path, process or file type, the reason and an owner.
2. Exclusions must be as narrow as possible: specific files or processes, never whole drives, user-writable folders or broad file types.
3. All exclusions must be held in [the exclusion register] and reviewed every [6 months]. Exclusions without an owner must be removed.
4. Protection may be disabled temporarily only for a documented change or troubleshooting, approved by [Security operations], for no more than [4 hours], with automatic re-enablement where the product supports it. See the EDR Tuning and Exclusions Management Guide.
5. Alerts must be raised when protection is disabled or tampered with outside an approved window.

4.5 Backup and recovery

1. Backups of critical systems must include at least one copy that is offline or immutable and cannot be changed from the production network.
2. Backup administration must use separate accounts with multi-factor authentication, not standard domain administrator accounts.
3. Restores must be tested at least [quarterly], and backups must be scanned before restoration after a malware incident. See the Backup Policy Template.

4.6 Awareness and reporting

1. All users must receive training at induction and at least [annually] on malicious attachments and links, fake updates, unapproved software and how to report.
2. Users must report a suspected infection to [the service desk] immediately and disconnect from the network if instructed. Prompt reporting will not lead to disciplinary action.
3. Malware warnings and advisories must be accepted only from trusted sources, such as [the security vendor, national CERT and Security operations]. Hoax warnings must not be forwarded.

4.7 Systems that cannot run standard protection

1. Systems where anti-malware is unsupported or would affect safety or operation, such as OT controllers or appliances, must be listed with an owner and compensating controls: network segmentation, application control or allow listing, media scanning kiosks and monitoring.
2. Files and media entering OT environments must be scanned on a dedicated, protected station first. See the OT Security Policy Template.
3. Unsupported operating systems must be segregated from the rest of the network until replaced.

4.8 Incident handling

1. Confirmed malware must be handled under [the incident response plan] and the Malware Outbreak Playbook, including isolation of affected hosts, evidence preservation and credential resets where credentials may have been exposed.
2. Credentials, tokens and keys stored on or used from an infected host must be treated as compromised and rotated, including service account and API credentials. Information-stealing malware targets these directly.
3. Lessons learned must feed back into the exclusion register, filtering rules and application control policy.

5. Exceptions

1. Exceptions must be requested through [the exception process] with the business reason, compensating controls and an expiry date of no more than [12 months].
2. Exceptions to sections 4.2 (application control and admin rights) and 4.3 (coverage) must be approved by [the CISO].
3. All exceptions must be recorded in [the risk register].

6. Compliance and monitoring

Breaches of this policy may lead to removal of access and to action under [the disciplinary policy].

7. Review and approval

Implementation guidance

The sequence below is NHI Mgmt Group's recommendation.

1. Reconcile coverage first. Compare the anti-malware console with the asset inventory; the gap is usually servers, cloud VMs and unmanaged devices. Fixing coverage is the biggest single gain.
2. Clean up exclusions. Export the current list, remove broad entries, assign owners and set review dates. Test removal on a pilot group first; restore a specific exclusion if a business application breaks, never a broad one.
3. Introduce application control in audit mode. Run in audit for [30 days] on servers and privileged workstations, review what would be blocked, then enforce ring by ring with a fast rollback path.
4. Remove local admin rights with a request route for genuine needs, and block internet macros.
5. Size it to the organisation. A small organisation can meet most of this with built-in operating system protection, managed centrally, plus macro blocking and offline backups; the NCSC's malware and ransomware guidance recommends offline backups and constraining macros. Larger estates need EDR, sandboxing and a formal exclusion register.

Framework mapping

The techniques this policy addresses include MITRE ATT&CK T1566 Phishing, T1204 User Execution and T1059 Command and Scripting Interpreter. CIS Safeguard detail is in the CIS Control 10 Malware Defenses Guide.

Standards and references

• ISO: ISO/IEC 27001:2022 Information security management systems
• NCSC: Mitigating malware and ransomware attacks
• NIST: SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
• CIS: Control 10, Malware Defenses
• NIST: SP 800-53 Rev. 5 (SI-3 Malicious Code Protection)

This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Malware Guide · EDR Guide · Essential Eight Guide · Endpoint Hardening Checklist