ISO 27001:2022 Annex A 8.7 – Protection Against Malware Explained

Malware rarely announces itself.
It blends into email, websites, updates, and everyday activity — until systems stop working or data is gone.

Annex A 8.7 exists to ensure organisations prevent, detect, and respond to malware effectively, reducing the risk of disruption, data loss, and compromise across the environment.

This control is about defence in depth, not blind reliance on anti-virus tools.

Quick Guide: Annex A 8.7 at a Glance

Annex A 8.7 of ISO 27001:2022 focuses on protection against malware.

At a practical level, this means:

Preventing malware from entering systems and networks
Detecting malicious software quickly
Limiting spread and impact when malware is present
Educating users about malware-related risks
Maintaining the ability to recover after infection

The control does not state that anti-malware software alone is sufficient. It expects a coordinated, multi-layered approach.

In-Depth Guide to Annex A 8.7

What Is Annex A 8.7 and Why Does It Matter?

Malware remains one of the most common causes of:

System outages
Ransomware incidents
Data breaches
Operational disruption

Attack vectors continue to evolve, including:

Email and phishing
Malicious websites
Compromised software updates
Removable media
Abuse of legitimate administrative tools

Annex A 8.7 ensures organisations do not rely on a single control, but address malware risk across people, process, and technology.

This control supersedes ISO 27001:2013 Annex A 12.2.1 and places stronger emphasis on awareness, layered controls, and resilience during abnormal operations such as maintenance.

How to Implement Annex A 8.7 Effectively

A pragmatic approach to Annex A 8.7 typically includes the following elements.

1. Establish a Malware Protection Approach

Organisations should define how malware risks are addressed, including:

Prevention
Detection
Response
Recovery

This approach should align with organisational risk, threat landscape, and operating environment.

2. Deploy Anti-Malware Controls Where Appropriate

Anti-malware software remains an important component.

Organisations typically:

Deploy malware detection on endpoints and servers
Keep signatures and engines up to date
Configure controls to reflect risk and usage

However, Annex A 8.7 explicitly recognises that anti-malware tools alone are not sufficient.

3. Control Software and System Changes

Malware frequently exploits weak change control.

Organisations should:

Restrict installation of unauthorised software
Apply structured change management
Monitor for unauthorised system changes

Uncontrolled software installation significantly increases exposure.

4. Reduce Exposure to Malicious Content

Annex A 8.7 supports reducing opportunities for infection.

This may include:

Blocking access to known malicious or inappropriate websites
Filtering email and attachments
Restricting use of removable media
Limiting execution of untrusted files

Reducing exposure lowers detection and response burden.

5. Apply a Defence-in-Depth Model

Effective malware protection uses multiple layers.

This commonly includes:

Endpoint protection
Gateway or network-level controls
Segmentation to limit lateral movement
Monitoring and logging

If one layer fails, others reduce impact.

6. Detect and Respond to Malware Activity

Detection must lead to action.

Organisations should ensure:

Malware alerts are reviewed
Suspected infections are investigated
Response actions are defined and tested

Silent detection is not effective detection.

7. Protect During Maintenance and High-Risk Activities

ISO 27001:2022 places explicit emphasis on malware risk during:

System maintenance
Emergency changes
Incident response activities

Temporary weakening or disabling of controls should be:

Authorised
Time-limited
Compensated with additional safeguards

Maintenance periods are a common exploitation window.

8. Provide Malware Awareness and Training

People remain a primary malware entry point.

Training should help personnel:

Recognise phishing and social engineering
Understand risks of untrusted software
Report suspicious activity promptly

Awareness reduces both likelihood and dwell time.

9. Maintain Backup and Recovery Capability

Malware incidents often require recovery rather than cleanup.

Organisations should ensure:

Backups are protected from malware
Recovery procedures are tested
Critical systems can be restored reliably

Recovery capability is a key resilience measure, particularly for ransomware scenarios.

10. Monitor Threat Intelligence and Supplier Alerts

Organisations should:

Stay informed about emerging malware threats
Validate alerts from trusted suppliers and sources
Adjust controls in response to relevant threat intelligence

Static controls degrade quickly in a dynamic threat landscape.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.7 does not require:

Multiple anti-malware platforms by default
Zero tolerance for operational exceptions
A purely technical solution

It does require organisations to:

Treat malware as an ongoing risk
Apply layered, coordinated controls
Avoid overconfidence in single tools

Malware incidents usually exploit gaps between controls, not the absence of controls.

Common Challenges and How to Overcome Them

Over-reliance on anti-virus software
Apply layered prevention, detection, and response

Users unaware of malware risk
Reinforce awareness and reporting behaviour

Controls weakened during maintenance
Apply time-bound, authorised exceptions with safeguards

No recovery plan for malware incidents
Align malware protection with backup and recovery controls

Malware defence fails most often through assumption.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.7 is about reducing the likelihood, impact, and duration of malware incidents.

When protection against malware is implemented effectively:

Disruption is reduced
Data loss is less likely
Detection happens earlier
Recovery is faster and more predictable

Malware is not a single threat.
It is a constant pressure on systems, people, and processes.

Annex A 8.7 ensures organisations respond to that reality — deliberately and consistently.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.7 – Protection Against Malware Explained

Quick Guide: Annex A 8.7 at a Glance

In-Depth Guide to Annex A 8.7

What Is Annex A 8.7 and Why Does It Matter?

How to Implement Annex A 8.7 Effectively

1. Establish a Malware Protection Approach

2. Deploy Anti-Malware Controls Where Appropriate

3. Control Software and System Changes

4. Reduce Exposure to Malicious Content

5. Apply a Defence-in-Depth Model

6. Detect and Respond to Malware Activity

7. Protect During Maintenance and High-Risk Activities

8. Provide Malware Awareness and Training

9. Maintain Backup and Recovery Capability

10. Monitor Threat Intelligence and Supplier Alerts

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!