Malware rarely announces itself. It blends into everyday emails, innocent file downloads, compromised software updates, and routine maintenance until systems stop working, files are encrypted, or data is quietly exfiltrated. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses place blind, absolute faith in a basic antivirus tool, assuming they are safe—only to be completely crippled by a modern ransomware strain that bypassed the antivirus on day one. Relying solely on antivirus software is not a strategy; it is a ticking time bomb.
ISO 27001:2022 includes Annex A 8.7 to ensure your organisation adopts a coordinated, multi-layered defence against malicious software. This control replaces the former 2013 requirement (12.2.1) and shifts the focus toward genuine defence in depth, user awareness, supply chain monitoring, and resilience during maintenance work.
Quick Summary: What ISO 27001 Annex A 8.7 Requires
At a practical level, Annex A 8.7 is about building multiple, overlapping security layers across your people, processes, and technology so that if one defensive layer fails, others stop the attack. Here is what you need to do in plain English:
- Deploy Multi-Layered Endpoint & Gateway Controls: Combine Next-Generation Antivirus (NGAV) / EDR with web filtering and email security gateways.
- Restrict Unauthorised Software Installation: Remove local admin rights from standard users to block unapproved executable files.
- Filter Inbound Content & Web Access: Block known malicious URLs, restrict risky email attachments, and lock down removable storage media.
- Protect Systems During Maintenance Windows: Enforce strict, time-bound approvals and compensating controls if security tools are temporarily disabled during repairs.
- Train Staff on Social Engineering & Phishing: Educate employees regularly to recognize suspicious links, fake software prompts, and phishing tactics.
- Maintain Immutable, Isolated Backups: Protect offline or cloud backups from malware contamination so systems can be restored fast after an infection (Annex A 8.13).
Why Relying Only on Traditional Antivirus Is a Major Risk
Traditional antivirus tools rely primarily on known signature databases. Modern cyber threats use polymorphic code, zero-day vulnerabilities, fileless living-off-the-land techniques, and stolen credentials that signature-based scanners miss completely. Relying on a single endpoint tool creates a single point of failure.
Ignoring multi-layered protection against malware exposes your business to severe hazards:
- Catastrophic Ransomware Encryption: Automated ransomware spreading laterally across unsegregated corporate subnets, encrypting live servers and network shares.
- Undetected Infostealers & Spyware: Background malware harvesting corporate passwords, session tokens, and financial details without triggering simple antivirus alerts.
- Exploitation During Maintenance Windows: Attackers striking when Endpoint Detection and Response (EDR) agents are turned off during system upgrades.
- Supply Chain Contamination: Downloading malicious code embedded inside unvetted third-party software updates or open-source packages.
My 10 Step Plan to Implement Annex A 8.7 Fast
You do not need an enterprise budget or a massive dedicated Security Operations Centre (SOC) to satisfy an ISO 27001 auditor. Here is my pragmatic, 10-step plan to establish an audit-ready, multi-layered malware defence.
1. Publish a Comprehensive Malware Protection Policy
Establish a clear policy that covers the full malware lifecycle: prevention, detection, response, and recovery. Ensure your policy defines:
- Mandatory security controls required across all endpoints, servers, cloud instances, and email gateways.
- Rules governing software installation permissions and acceptable internet usage.
- Explicit escalation protocols for reporting and containing suspected malware infections.
2. Deploy Endpoint Detection and Response (EDR)
Upgrade legacy signature-only antivirus tools to modern Endpoint Detection and Response (EDR) or Next-Gen Antivirus (NGAV) platforms:
- Deploy central EDR agents across all corporate laptops, desktops, and live production servers.
- Configure automated behavioral detection to block suspicious script execution (like PowerShell or CMD abuse).
- Enforce automatic signature, engine, and cloud-intelligence updates daily.
3. Restrict Local Administrative Privileges
The vast majority of malware infections require elevated administrative permissions to execute or install services. Block access at the source:
- Remove local administrator rights from standard employee user accounts across all endpoints (least privilege).
- Use Application Control / AppLocker policies to block execution of unapproved software or scripts running from temporary folders.
- Enforce strict change control workflows for installing new software packages on operational systems (Annex A 8.19).
4. Filter Email and Web Traffic at Boundaries
Stop malicious payloads long before they ever land on employee endpoints or corporate servers:
- Deploy Advanced Email Security Gateways to scan attachments, detonate suspicious files in sandboxes, and rewrite risky web links.
- Implement Secure Web Gateways (SWG) or DNS filtering to block access to known malicious domains and unapproved file-sharing sites (Annex A 8.23).
- Disable dangerous file attachment types (e.g., `.exe`, `.scr`, `.vbs`, macro-enabled office files) at your email boundary.
5. Lock Down Removable Media and External Storage
USB drives and external hard drives remain primary vectors for offline malware propagation and data exfiltration:
- Disable USB mass storage ports by default on user endpoints via central policy (MDM / Group Policy).
- Require mandatory hardware encryption and automated scanning for authorized USB devices (Annex A 8.12).
- Block autorun/autoplay functionality across all operating systems.
6. Build a Defence-in-Depth Network Architecture
Never rely on endpoint tools alone. Structure your network to limit malware propagation and lateral movement:
- Segregate corporate user subnets away from core database and server zones using firewalls (Annex A 8.22).
- Implement Zero Trust Network Access (ZTNA) or micro-segmentation for remote workers connecting to internal platforms.
- Inspect internal network traffic for abnormal lateral scanning or command-and-control communication (Annex A 8.20).
7. Protect Systems During Maintenance Windows
ISO 27001:2022 highlights maintenance activities as a high-risk window for malware intrusion. Lock down maintenance work:
- Require formal, time-bound approval before temporarily disabling or pausing security tools during system maintenance.
- Apply compensating safeguards (such as isolating the system from the network) while security controls are paused.
- Re-enable and verify all endpoint protection tools immediately upon completing maintenance tasks.
8. Provide Regular Security Awareness and Phishing Training
Your employees are your primary entry point for malware attacks. Build continuous security awareness:
- Run quarterly simulated phishing exercises to train staff on spotting fake emails, urgent requests, and suspicious links.
- Educate users on the risks of downloading unvetted utilities, pirated software, or browser extensions.
- Provide a simple, single-click “Report Phishing” button in employee email clients to encourage fast reporting.
9. Maintain Offline or Immutable Backups
Ransomware actively targets live backup shares to prevent recovery. Ensure your recovery strategy resists malware (Annex A 8.13):
- Isolate secondary backups using air-gapping or Write-Once-Read-Many (WORM) immutable cloud storage buckets.
- Ensure production admin credentials cannot alter or delete secondary backup archives.
- Test full system restoration playbooks regularly from clean backup images.
10. Monitor Threat Intelligence and Supplier Advisories
Static security rules degrade quickly against evolving threat landscapes. Stay informed and proactive:
- Subscribe to threat intelligence feeds from national cybersecurity bodies (e.g., NCSC, CISA) and security vendors.
- Monitor vendor security bulletins for critical vulnerabilities affecting your operating systems or software stack (Annex A 8.8).
- Tune EDR detection rules, firewall blocks, and email filters regularly based on emerging threat indicators.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same malware protection mistakes. Here are the main traps and how to solve them:
- Problem: Relying on a Single Legacy Antivirus Program Installed 5 Years Ago
Ninja Solution: Upgrade to a modern EDR/NGAV solution that monitors process behavior rather than relying strictly on static file signatures. - Problem: Local Admin Rights Granted to All Users for Convenience
Ninja Solution: Strip local admin rights globally and deploy a streamlined software approval process for legitimate business tools. - Problem: EDR Agents Left Permanently Disabled After a Maintenance Session
Ninja Solution: Implement automated daily compliance reports that alert IT leads if any endpoint or server drops off the central EDR console. - Problem: Backups Stored on the Same Active Network Domain as Servers
Ninja Solution: Separate backup repositories onto distinct, isolated subnets with dedicated, non-domain administrative credentials.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.7 is about replacing blind faith in antivirus software with a coordinated, resilient defence in depth. Malware is a constant operational pressure, but you can easily prevent a single infected file from becoming a catastrophic business failure.
By deploying EDR, stripping local administrative rights, filtering web and email channels, securing maintenance windows, training employees, and protecting immutable backups, you stop attacks early, ensure rapid recovery, and satisfy your ISO 27001 auditor with complete confidence.