A8.1: Are all your devices protected by anti-malware software or application allow listing?
Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either: A - Having anti-malware software installed and/or B - Limiting installation of applications by application allow listing - for example, using an app store and a list of approved applications, using a Mobile Device Management (MDM) solution or C - None of the above, please describe
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A8.1 answer selects every option in use. Option A, anti-malware software, covers Windows and macOS devices including servers. Option B, application allow listing through an app store and an approved list, covers any device and is the normal answer for phones and tablets. Most organisations select both. Option C does not meet the requirement.
Is A8.1 an automatic fail?
No. A8.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Multiple choice + notes a multiple choice question
- IASME guidance
- Please select all the options that are in use in your organisation across all your devices. Most organisations that use smartphones and standard laptops will need to select both option A and B.
- Logic
- Options: A - anti-malware software B - limiting installation of applications by "application allow listing" from an approved app store C- None of the above and requires notes field to provide description
- Requirement enforced
You must make sure that a malware protection mechanism is active on all devices in scope. For each device, you must use at least one of the options listed below.
- Anti-malware software (option for in-scope devices running Windows or MacOS including servers, desktop computers, laptop computers)
- Application allow listing (option for all in-scope devices). Only approved applications, restricted by code signing, are allowed to execute on devices.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A7.17AUTO-FAILA8.2Back to the malware protection control
What does A8.1 ask?
A8.1 asks: “Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either: A - Having anti-malware software installed and/or B - Limiting installation of applications by application allow listing - for example, using an app store and a list of approved applications, using a Mobile Device Management (MDM) solution or C - None of the above, please describe”
A8.1 asks whether all desktop computers, laptops, tablets and mobile phones are protected from malware by having anti-malware software installed (option A), by limiting installation of applications through application allow listing such as an app store with an approved list and MDM (option B), or neither (option C). The guidance says to select all options in use and that most organisations with smartphones and standard laptops will need to select both A and B.
The requirement: a malware protection mechanism must be active on all devices in scope, and for each device you must use at least one of anti-malware software (for Windows or macOS devices including servers, desktops and laptops) or application allow listing (for all in-scope devices), where only approved applications restricted by code signing can execute.
The follow-up questions depend on your selection: A8.2 and A8.3 for option A, A8.4 and A8.5 for option B. See malware protection requirements and CE Plus test case 3.
Which option should you choose for A8.1?
Choose the option for A8.1 that is enforced today across the whole scope, and complete the notes wherever the option requires them.
Select A if any Windows or macOS device relies on anti-malware software (Microsoft Defender counts). Select B if any device, typically iOS or Android, relies on the app store and an approved application list. Select both when you have laptops and phones. Select C only if some device has neither, and expect the assessor to ask what protects it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Only needed for option C, or to add clarity] Windows laptops and servers ([n] devices): Microsoft Defender Antivirus managed by [Intune / Defender for Endpoint], real-time protection and SmartScreen enforced (option A). macOS ([n] devices): [product] managed by [Jamf] (option A). iOS and Android ([n] devices): apps installed only from the App Store or Google Play, approved application list maintained in [MDM] and enforced by [MDM policy]; devices cannot be jailbroken or rooted (option B). [Any device using neither: describe the compensating control.]
Why do applicants fail A8.1?
A common reason applicants fail A8.1: selecting option A only and forgetting that phones and tablets have no anti-malware, leaving them with no declared protection.
- Selecting option B for laptops on the basis of 'we tell staff not to install things', which is not allow listing restricted by code signing.
- Anti-malware that is installed but not updating, or a product that is no longer supported (check A6.2.2).
- Option C with a note that describes a firewall or email filtering, which are not malware protection mechanisms on the device.
How do you fix a failing A8.1 answer?
If your answer to A8.1 would not pass today, fix the control first and then write the answer. In order:
- Map each device type in A2.6 to A2.8 to a protection: anti-malware (option A) or application allow listing (option B).
- Select every option in use; most organisations select both A and B.
- Install anti-malware on any Windows or macOS device without it.
- Configure app store restrictions and an approved list for phones and tablets.
How do assessors check A8.1?
What evidence should you keep for A8.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A8.1:
- A list of device types with the malware protection option each uses.
Where to go next
- Microsoft Defender for BusinessOption A on Windows and macOS
- Allow listingGlossary
- Anti-malware softwareGlossary
- CE Plus test 3: malware protectionTest files by email and browser
- Malware Protection requirementsThe control this question tests
- All A8 questionsMalware protection
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A8 questions
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
Frequently asked questions
A8.1 in the 2026 Danzell Cyber Essentials question set asks: "Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either: A - Having anti-malware software installed and/or B - Limiting installation of applications by application allow listing - for example, using an app store and a list of approved applications, using a Mobile Device Management (MDM) solution or C - None of the above, please describe" It is a multiple choice question.
A compliant A8.1 answer selects every option in use. Option A, anti-malware software, covers Windows and macOS devices including servers. Option B, application allow listing through an app store and an approved list, covers any device and is the normal answer for phones and tablets. Most organisations select both. Option C does not meet the requirement.
No. A8.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. The A8.2 guidance says that for the avoidance of doubt Windows Defender is suitable for this purpose, provided it updates in line with Microsoft's guidelines and prevents malware from running on detection.
No. Phones and tablets normally meet the control through option B, application allow listing: apps only from the platform store, an approved list maintained by the organisation, and users unable to install unsigned apps. A8.4 and A8.5 cover the detail.
Yes, and the guidance says most organisations that use smartphones and standard laptops will need to. The answer-type note in the Danzell spreadsheet says applicants must be able to select both options and answer the follow-up questions for each.
A8.1 names desktops, laptops, tablets and phones, but the requirement applies to all devices in scope and option A is described as the option for Windows or macOS devices including servers. Servers need anti-malware or allow listing, and CE Plus samples servers that provide a user-interactive desktop.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh