A8.3: Does your anti-malware or browser block malicious websites?
If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
If you selected option A in A8.1, answer Yes to A8.3 only if your anti-malware software or web browser on every relevant device scans or checks web pages and warns users or blocks access to known malicious websites. On Windows 11, Microsoft Defender SmartScreen provides this. Make sure it is enforced in every browser people use.
Is A8.3 an automatic fail?
No. A8.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Your anti-malware software or internet browser should be configured to prevent access to known malicious websites. On Windows 11, MS Defender SmartScreen can provide this functionality.
- Requirement enforced
If you use anti-malware software to protect your device it must be configured to:
- prevent connections to malicious websites over the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A8.2A8.4Back to the malware protection control
What does A8.3 ask?
A8.3 asks: “If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?”
A8.3 asks, where you have anti-malware software installed, whether it is set to scan web pages you visit and warn you about accessing malicious websites. The guidance says your anti-malware software or internet browser should be configured to prevent access to known malicious websites, and that on Windows 11 Microsoft Defender SmartScreen can provide this.
The requirement: anti-malware software must be configured to prevent connections to malicious websites over the internet. Browser protections such as Google Safe Browsing and Edge SmartScreen, or a DNS or web filter, are common ways to meet it. CE Plus test case 3 includes a sub-test of malware delivered by browser.
What must be true to answer Yes to A8.3?
You can answer Yes to A8.3 only when all of the following are true today, across every device, user and cloud service in scope.
- SmartScreen or equivalent web protection is on in Edge and in Windows, enforced by policy.
- Chrome and Firefox have Safe Browsing on, or a web filter covers them.
- Macs have equivalent protection in Safari or the anti-malware product.
- Users cannot turn the protection off.
Why do applicants fail A8.3?
A common reason applicants fail A8.3: smartScreen on in Edge but Chrome Safe Browsing turned off.
- Web protection that only works on the office network, not at home.
- Users able to bypass warnings without restriction on managed devices.
- A web filter licence that has lapsed.
How do you fix a failing A8.3 answer?
If your answer to A8.3 would not pass today, fix the control first and then write the answer. In order:
- Enforce SmartScreen in Edge and Windows, and Safe Browsing in Chrome and Firefox, through policy.
- Make sure the protection works off the office network, or add a device-level web filter.
- Stop users turning it off.
How do assessors check A8.3?
What evidence should you keep for A8.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A8.3:
- The SmartScreen or web protection policy for each browser in use.
Where to go next
- Microsoft Defender for BusinessSetup guide
- Windows 11 setupSetup guide
- CE Plus test 3: malware protectionTest files by email and browser
- Malware Protection requirementsThe control this question tests
- All A8 questionsMalware protection
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A8 questions
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Multiple choice + notes
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
Frequently asked questions
A8.3 in the 2026 Danzell Cyber Essentials question set asks: "If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?" It is a Yes/No question.
If you selected option A in A8.1, answer Yes to A8.3 only if your anti-malware software or web browser on every relevant device scans or checks web pages and warns users or blocks access to known malicious websites. On Windows 11, Microsoft Defender SmartScreen provides this. Make sure it is enforced in every browser people use.
No. A8.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. IASME's A8.3 guidance says Microsoft Defender SmartScreen can provide this functionality on Windows 11.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh