Cyber Essentials Plus Test 3: the malware protection tests

What does Test 3 check?

Test 3 checks that the malware protection you declared at A8.1 works on each sampled device: anti-malware must stop test files delivered by email and browser, and allow listing must stop unsigned applications running.

The self-assessment asks in A8.1 which malware protection option each device uses: anti-malware software (option A) or application allow-listing (option B). Test 3 verifies that choice on the sampled devices. The assessor first identifies which method each device uses, then runs the matching sub-tests.

What are the test files?

The Delivery Partner supplies a comprehensive set of inert test files to the Certification Body, which tailors a sub-set to each applicant's platforms. A Mac-only estate is not tested with Windows file types; a mixed estate gets a wider set. Appendix B distinguishes two groups with different pass criteria.

• Container formats such as .zip and .gz that the environment can process.
• File types executable by default on common platforms, both native binaries and scripting languages.
• Document and spreadsheet types users regularly receive, containing inert malware samples.
• Executable test files launch obvious behaviour (opening a browser page or a dialog) so the assessor can see execution immediately.
• Malware samples are specific inert files known to be flagged by the majority of common antivirus products.

Sub-test 3.1.1: what happens with the email test?

Performed on any sampled device or service where a user can receive email. The assessor uses an external mail system that performs no filtering and is not deny-listed, so the result reflects your defences rather than the sender's.

Sub-test 3.1.2: what happens with the browser download test?

Performed on any sampled device where a user can browse the web. The files are hosted on an external website owned by the Certification Body. You are asked to configure your web filter so this site receives the same level of filtering as most other allowed sites, because the test assumes there is always some allow-listed site a user can download from.

Sub-test 3.1.3: when do manual checks apply?

Where the test files did not prove the software is configured correctly (for example on a server without a mail client, or where a product's behaviour cannot be demonstrated with files), the assessor performs manual checks on every sampled device using anti-malware software.

Sub-test 3.2: how is application allow-listing tested?

For devices that rely on certificate-based application allow-listing (option B in A8.1), the assessor checks four things on each sampled device.

How do you pass Test 3?

• Confirm the anti-malware agent is installed, running and reporting on every sampled device, including servers with a desktop and IaaS instances. Check the console for devices that have not reported in.
• Make sure definitions and the engine update per the vendor's instructions (A8.2), and that real-time protection and web protection are on so malicious sites are blocked (A8.3).
• Disable auto-run and auto-execution of downloaded files (A5.8), so executables prompt rather than run.
• Test the email path yourself: send an inert test file such as the EICAR string from an external mailbox and confirm it is blocked at the gateway or on the device.
• If you use a web filter, allow the Certification Body's test site at the same level as ordinary sites, so the test reflects device protection rather than the filter alone.
• For allow-listing (AppLocker, WDAC, Apple managed apps), test an unsigned executable on a sampled device and confirm it is refused.

How do assessors check this?