In which policy to place company anti-malware requirements

JulienB — Mon, 09 Oct 2023 09:40:41 GMT

Hi,

I am currently refreshing our policies, however I am not sure what is the best place to place requirements for the antimalware client.

Would you place these in an independent policy (e.g. Antimalware policy) or as part of another one?

Thanks

Re: In which policy to place company anti-malware requirements

Steve-Wilme — Fri, 30 Oct 2020 12:10:54 GMT

It can be referenced from several place as anti malware controls aren't necessarily just a software product on endpoints. So at a policy level you'd have a statement that the standard antimalware product had to be part of every build and that it mustn't be disabled or uninstalled. At a standards level you'd define how the product must be configured in terms of its features and their management.

You may also have other malware controls in place around ingress of data e.g. email and web filtering, deep pack inspection for malware, restrictions on removable media etc. You may also want to restrict what programs can download and/or execute, so you're only running known good software. Some of those you'd need to put in your AUP to set expectations on staff behaviour.

topic Re: In which policy to place company anti-malware requirements in Governance, Risk, Compliance

In which policy to place company anti-malware requirements

Re: In which policy to place company anti-malware requirements