A.8.7
Protection against malware
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Implement detection and prevention controls against malware on systems where feasible.
Points of focus
- Deploy endpoint protection (EDR) on all corporate devices, including remote and BYOD where permitted
- Scan dependencies, container images, and build artifacts for known malicious or vulnerable code in CI/CD
- Filter email and web traffic for known malware delivery vectors
- Combine prevention with detection and a documented response path, since no single control catches everything
Implementation notes
Split this control into the layers where malicious code can actually enter a SaaS environment. On corporate endpoints, deploy EDR across company-managed devices and cover any permitted personal-device access with equivalent controls or restrict what those devices can reach. In the software supply chain — the layer traditional antivirus doesn't touch — run software composition analysis on dependencies and scan container images for known vulnerabilities and malicious packages as a required step in the CI/CD pipeline, with findings above an agreed severity threshold actually blocking the build rather than just generating a report no one reads. Rescan running images periodically against newly disclosed CVEs, since a scan that only runs once at build time misses vulnerabilities disclosed after deployment. Layer in email and web filtering for the most common human-targeted delivery vector, and if the product accepts file uploads from customers, scan uploaded content before it's processed or stored. No single layer is complete on its own, so pair prevention with basic detection and a documented response step for when something is actually caught.
Audit tip: Bring the CI/CD scanning configuration, not just an antivirus dashboard screenshot. Auditors evaluating SaaS companies now expect supply-chain protections (dependency and image scanning) as part of this control, especially where the deployment footprint is mostly containers rather than physical servers.
Evidence auditors typically request:
- EDR/endpoint protection deployment report showing coverage percentage across corporate devices
- CI/CD pipeline configuration showing dependency (SCA) and container image scanning as a build gate
- Email/web filtering configuration or vendor report covering the observation window
- Malware detection/incident log showing at least the process exists, even if no real events occurred
Common gaps
- EDR is deployed on company-issued laptops but unmanaged personal devices with email access are excluded from the inventory entirely
- Dependency scanning runs in CI but findings above a certain severity don't actually block the build, so vulnerable packages ship anyway
- Container images are scanned pre-deployment once, but there's no process to rescan images already running against newly disclosed vulnerabilities
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.8.7 | This control |
| SOC 2 | CC6.8 | CC6.8 specifically addresses detecting and preventing malicious software introduction — for cloud-native SaaS, examiners now expect this evidence to include CI/CD scanning, not just endpoint antivirus reports. |
| HIPAA | 164.308(a)(5) | 164.308(a)(5)(ii)(B) calls out protection from malicious software as part of the security awareness and training standard, tying the technical control back to workforce training on recognizing malware delivery attempts like phishing. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.7)