Malware
Malware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware. Cyber Essentials control 5, malware protection, requires an active protection mechanism on every device in scope: anti-malware software, application allow listing, or both. A8.1 asks which option each device uses.
- Term
- Malware
- Also known as
- Malicious software, Computer virus
- Category
- Malware, cloud and threats
- Requirement area
- 5. Malware protection
- Questions
- A8.1
- Reviewed against
- Requirements v3.3
What does the term malware mean in Cyber Essentials?
Malware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
Malware, such as computer viruses, worms and ransomware, is software that has been written and distributed deliberately to perform malicious actions.
How does malware apply to Cyber Essentials?
In plain terms
Think of malware as a burglar who gets in by being invited. It usually arrives looking like something ordinary: an invoice attached to an email, a free tool from a website, or an app that looks useful. Once it runs, it can steal passwords, lock your files or quietly spread to other machines.
What Cyber Essentials asks
The malware protection control aims "to restrict execution of known malware and untrusted software, from causing damage or accessing data." The requirements list the usual sources as "malicious email attachments, downloads (including those from application stores), and direct installation of unauthorised software", and say you can largely avoid the harm by "preventing malware from being delivered to devices" and "preventing malware from running on devices".
Every device in scope needs at least one of two options: anti-malware software (for Windows and macOS devices, including servers) or application allow listing (for any device). A8.1 asks which you use. A8.2 and A8.3 cover anti-malware settings, and A8.4 and A8.5 cover allow listing.
What an assessor looks for
- Every device type covered. The A8.1 guidance says most organisations with smartphones and standard laptops will need to select both options.
- Protection that is active and "kept up to date in accordance with the vendor's instructions".
- At Cyber Essentials Plus, test case 3 sends test files to sampled devices by email and browser download and checks that the malware test files are blocked.
See the malware protection requirements and Cyber Essentials Plus test 3. Related: ransomware, phishing.
Related terms
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
Frequently asked questions
Malware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, malware comes up at A8.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Malware relates to 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.