Section 8: Malware protection
Choose every protection you use across all your devices. Most schools with laptops and phones or tablets need both A and B. If you choose only A but have phones or tablets in scope leaves devices uncovered.
Anti-malware software (A) is only an option for devices running Windows or macOS, including servers, desktops and laptops. IASME says Microsoft Defender and macOS XProtect can be used for this.
No anti-malware product is accepted for mobile devices, so phones, tablets and other devices without Windows or macOS need application allow listing (B): only apps your school has approved can run or reach school data.
Choose C if A and B don’t apply and describe what you do (NCSC Requirements v3.3, pages 23 to 24).
If you chose A in 8.1, check the settings of your anti-malware software. It must update automatically in line with the maker's guidance and stop malware running when it detects it. This is usually the default. NCSC requires anti-malware to be updated in line with vendor recommendations, prevent malware from running and prevent execution of malicious code (Requirements v3.3, page 24).
Microsoft Defender and macOS XProtect are accepted by IASME.
If you did not select A in 8.1 write A was not selected in 8.1 - we do not use anti-malware software; devices use application allow listing.
NCSC requires anti-malware to prevent connections to malicious websites over the internet (Requirements v3.3, page 24).
If you chose A in 8.1, your anti-malware software or internet browser must scan web pages people visit and block or warn about known malicious websites. On Windows 11, Microsoft Defender SmartScreen can do this.
If you did not choose A in 8.1, write A was not selected in 8.1 - we do not use anti-malware software; devices use application allow listing.
If you chose B in 8.1, application allow listing means only approved applications restricted by code signing can run on a device. Windows, Chromebooks, phones and tablets normally only install signed apps from their app store unless the device has been “rooted” or “jailbroken.”
Make sure users cannot install unsigned apps (NCSC Requirements v3.3, page 24).
If you did not choose B in 8.1, write B was not selected in 8.1 - we do not use application allow listing; devices use anti-malware software.
NCSC requires you to actively approve applications before deploying them and to maintain a current list (Requirements v3.3, page 24).
If you chose B in 8.1, you must:
- decide in advance which applications are approved
- keep a current written list of approved applications
- make sure users can only install those approved and on the list, including on staff personal devices that reach school data
For personally owned devices, IASME is only concerned with applications that access school data and services. You do not need a mobile device management tool if policy, process and training meet the requirement.
If you did not choose B in 8.1, write B was not selected in 8.1 - we do not use application allow listing; devices use anti-malware software.
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.