ISO 27001:2022 Annex A Control 8.7

Guidance on ISO 27001:2022 Annex A 8.7 Compliance

Annex A 8.7 requires companies to execute a malware defence that encompasses four main aspects:

1. Controlled systems and account access.
2. Change management.
3. Anti-malware software.
4. Organisational information security awareness (user training).

ISO cautions against believing that anti-malware software is enough to provide a secure environment. ISO 27001:2022 Annex A 8.7 calls for organisations to adopt an end-to-end strategy against malware, one that begins with educating users and culminates in a secure network that minimises the possibility of intrusion from a multitude of attack sources.

Organisations should take measures to achieve their goal, including:

• Discourage the employment of unapproved software (consult Annex A 8.19 and Annex A 8.32).
• Stop access to malicious or unsuitable sites.
• Reduce the number of susceptibilities existing on their network which could be taken advantage of by malware or individuals with ill intentions (observe Annex A 8.8 and Annex A 8.19).
• Conduct frequent software assessments to detect unauthorised software, system modifications, and/or data on the network.
• Secure data and applications with minimal risk, through internal or external acquisition.
• Organisations should implement a malware detection policy that involves regular and comprehensive scans of all pertinent systems and files, tailored to each area’s distinct risks. A ‘defence in depth’ approach including endpoint devices and gateway controls should be adopted, accounting for numerous attack vectors (e.g. ransomware).
• Ward off intrusions originating from emergency protocols and procedures – particularly when there is an incident or high-risk maintenance activities.
• Draft a process that enables technical staff to deactivate some or all anti-malware efforts when they impede the organisation’s operations.
• Implement a sturdy backup and disaster recovery (BUDR) plan that facilitates the organisation’s resumption of operations at the earliest opportunity, post disruption (see Annex A 8.13). This should comprise procedures for software that cannot be safeguarded by anti-malware software (e.g. machinery software).
• Divide the network and/or digital and virtual working spaces into sections to prevent catastrophic damage should an attack occur.
• Furnish all personnel with anti-malware training to raise their understanding of a large collection of topics, including (but not restricted to):
• Email security
• Installing malicious software
• Social engineering
• Gather information on the newest advancements in malware security pertaining to the industry.
• Ensure that all notifications regarding potential malware assaults (notably from software and hardware suppliers) come from a reliable source and are precise.

Accompanying Annex A Controls

• ISO 27001:2022 Annex A 8.13
• ISO 27001:2022 Annex A 8.19
• ISO 27001:2022 Annex A 8.32
• ISO 27001:2022 Annex A 8.8

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.7 supersedes ISO 27001:2013 Annex A 12.2.1 (which addressed controls against malware).

ISO 27001:2022 Annex A 8.7 is similar to ISO 27001:2013 Annex A 12.2.1, but some of the additional advice has been given a higher priority, considering its significance for firms’ anti-malware programmes. Specifically, it includes:

• Ensuring safety against malware during maintenance periods is essential.

ISO 27001:2013 Annex A 12.2.1 requests organisations to think about utilising two different anti-malware platforms, while ISO 27001:2022 Annex A 8.7 is content with a single integrated solution.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

Our platform gives you customisable dashboards that grant you real-time understanding of your compliance standing.

You can oversee and control the entirety of your ISO 27001:2022 conformance from one location, including audit management, gap analysis, training management, risk assessment, and more.

This comprehensive platform offers a simple and integrated solution that can be utilised around the clock from any device connected to the internet. It facilitates a seamless and secure collaboration among employees to monitor security risks and keep track of the organisation’s progress in attaining ISO 27001:2022 certification.

Contact us now to arrange a demonstration.