Cyber Essentials A8 questions: malware protection
The A8 questions test control 5: anti-malware software or application allow listing on every device, and how each is configured.
Section A8 tests malware protection. A8.1 asks whether every device uses anti-malware software, application allow listing or both; A8.2 and A8.3 check anti-malware updates, blocking and web protection; A8.4 and A8.5 check that only signed, approved applications can be installed.
- Questions
- 5 (A8.1 to A8.5)
- Auto-fails
- None
- CE Plus test
- Test 3: malware protection tests
What questions are in section A8?
Section A8 has 5 questions, A8.1 to A8.5, none of them automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Conditional: shown after an earlier answerMultiple choice + notes
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
How do assessors mark section A8?
Assessors read section A8 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.
Related requirements
- Malware Protection requirementsThe control hub with every requirement bullet
- All questionsThe eight sections
- Requirements overviewThe five controls
- What changed in 2026Danzell and v3.3
- Cyber Essentials checklistThe evidence to gather for each question
- Check your readinessScore your answers against the auto-fails first
Frequently asked questions
5, from A8.1 to A8.5. 1 of them are conditional and only appear depending on an earlier answer.
No. None of the A8 questions is an auto-fail, but unclear or contradictory answers are returned by the assessor for more information.
4 Yes/No, 0 notes and 1 multiple choice questions.
Yes. The A8.2 guidance states that for the avoidance of doubt Windows Defender is suitable for this purpose. It must be active, updating in line with Microsoft's recommendations, blocking malware on detection and, with SmartScreen or equivalent, preventing connections to malicious websites.
No. Mobile devices normally meet the control through option B, application allow listing: only signed apps from the app store, an approved list of applications, and users prevented from installing unsigned apps. A8.4 and A8.5 cover this, and MDM makes it easy to evidence.
Yes, servers are named in the applies-to list, and every in-scope server needs one of the two mechanisms. The requirements describe anti-malware software as the option for Windows and macOS devices including servers, and application allow listing as the option for all devices, so for a Linux server describe the mechanism you use and confirm it with your assessor. CE Plus test case 3 samples servers that provide a user-interactive desktop and IaaS instances.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh