A8.2: Does your anti-malware update automatically and block malware?
If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
If you selected option A in A8.1, answer Yes to A8.2 only if your anti-malware software on every relevant device is set to update in line with the vendor's guidelines and to prevent malware from running when it is detected. This is usually the default, and Windows Defender is suitable.
Is A8.2 an automatic fail?
No. A8.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- This is usually the default setting for anti-malware software. You can check these settings in the configuration screen for your anti-malware software.
- Requirement enforced
If you use anti-malware software to protect your device it must be configured to:
- be updated in line with vendor recommendations
- prevent malware from running
- prevent the execution of malicious code
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A8.1A8.3Back to the malware protection control
What does A8.2 ask?
A8.2 asks: “If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?”
A8.2 asks, where you have anti-malware software installed, whether it is set to update in line with the vendor's guidelines and prevent malware from running on detection. The guidance says this is usually the default setting, that you can check it in the product's configuration, that any commonly used anti-malware product, free or paid, is acceptable if it meets the requirements, and that for the avoidance of doubt Windows Defender is suitable.
The requirement: anti-malware software must be updated in line with vendor recommendations, prevent malware from running, and prevent the execution of malicious code. See Microsoft Defender for Business and CE Plus test case 3.
What must be true to answer Yes to A8.2?
You can answer Yes to A8.2 only when all of the following are true today, across every device, user and cloud service in scope.
- Security intelligence updates install automatically on every Windows and macOS device using option A.
- Real-time protection is on and cannot be turned off by users.
- Detected malware is blocked or quarantined, not just reported.
- A management console or report shows devices are up to date.
Why do applicants fail A8.2?
A common reason applicants fail A8.2: real-time protection turned off on developer or IT machines.
- A third-party product whose licence lapsed, so updates stopped.
- Exclusions so broad that whole drives are not scanned.
- Macs with no anti-malware product at all while A8.1 says option A.
How do you fix a failing A8.2 answer?
If your answer to A8.2 would not pass today, fix the control first and then write the answer. In order:
- Check the anti-malware management console for devices with out-of-date signatures or real-time protection off.
- Enforce automatic updates and real-time protection by policy.
- Set detections to block or quarantine, and narrow broad exclusions.
How do assessors check A8.2?
What evidence should you keep for A8.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A8.2:
- The anti-malware policy showing real-time protection and automatic updates, and a device health report.
Where to go next
- Microsoft Defender for BusinessSetup guide
- Signature-based detectionGlossary
- CE Plus test 3: malware protectionTest files by email and browser
- Malware Protection requirementsThe control this question tests
- All A8 questionsMalware protection
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A8 questions
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Multiple choice + notes
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
Frequently asked questions
A8.2 in the 2026 Danzell Cyber Essentials question set asks: "If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?" It is a Yes/No question.
If you selected option A in A8.1, answer Yes to A8.2 only if your anti-malware software on every relevant device is set to update in line with the vendor's guidelines and to prevent malware from running when it is detected. This is usually the default, and Windows Defender is suitable.
No. A8.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. IASME's A8.2 guidance says you can use any commonly used anti-malware product, free or paid-for, as long as it updates in line with vendor guidelines and prevents malware from running.
Yes. The A8.2 guidance states that Windows Defender is suitable for this purpose.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh