A6.2.2: Which malware protection software do you use, and which version?
Please list your malware protection software The version is required.
Source: IASME Cyber Essentials Danzell question set v16.3
A6.2.2 needs each anti-malware product in use on in-scope devices with its version, so the assessor can confirm it is supported. IASME's examples include Sophos, Microsoft Defender and Bitdefender. For Microsoft Defender Antivirus give the platform or engine version, and state how it is managed. If phones rely on app store allow listing, say so.
Is A6.2.2 an automatic fail?
No. A6.2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please list all malware protection and versions you use so that the Assessor can understand your setup and verify that they are in support. For example: Sophos Endpoint Protection V10, Microsoft Defender, Bitdefender Internet Security 2023.
- Requirement enforced
You must make sure that all software in scope is kept up to date. All software on in-scope devices must be licensed and supported.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.2.1A6.2.3Back to the security update management control
What does A6.2.2 ask?
A6.2.2 asks: “Please list your malware protection software The version is required.”
A6.2.2 asks you to list your malware protection software, and says the version is required. The guidance asks for all malware protection products and versions so the assessor can verify they are in support, with examples including Sophos Endpoint Protection, Microsoft Defender and Bitdefender.
This list must match your answer to A8.1: option A devices need a product here, and option B devices (usually phones and tablets) rely on application allow listing instead. A8.2 confirms that Windows Defender is suitable. See Microsoft Defender for Business and anti-malware software.
What should you write in the notes field for A6.2.2?
Write two to four specific sentences for A6.2.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Windows laptops and servers: Microsoft Defender Antivirus, platform [version], engine [version], security intelligence updating automatically, managed by [Intune / Defender for Business]. Macs: [Microsoft Defender for Endpoint / product] version [version]. iOS and Android: protected by application allow listing (A8.1 option B).
Why do applicants fail A6.2.2?
A common reason applicants fail A6.2.2: a third-party product whose licence has lapsed, so it no longer updates.
- Two products listed for the same devices with one disabled and out of date.
- No product listed for Macs that rely on option A.
- A product version the vendor no longer supports.
How do you fix a failing A6.2.2 answer?
If your answer to A6.2.2 would not pass today, fix the control first and then write the answer. In order:
- List each anti-malware product with its version, grouped by device type.
- Renew lapsed licences or replace unsupported products.
- Make sure the list matches A8.1: every option A device has a product here.
How do assessors check A6.2.2?
What evidence should you keep for A6.2.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.2.2:
- The anti-malware console's device and version report.
Where to go next
- Microsoft Defender for BusinessSetup guide
- Anti-malware softwareGlossary
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A6 questions
- A6.2A6.2Yes/NoIs all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?Yes/No
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
- A6.2.4A6.2.4NotesPlease list all office applications that are used to create organisational data.Notes
Frequently asked questions
A6.2.2 in the 2026 Danzell Cyber Essentials question set asks: "Please list your malware protection software The version is required." It is a notes question, answered in free text.
A6.2.2 needs each anti-malware product in use on in-scope devices with its version, so the assessor can confirm it is supported. IASME's examples include Sophos, Microsoft Defender and Bitdefender. For Microsoft Defender Antivirus give the platform or engine version, and state how it is managed. If phones rely on app store allow listing, say so.
No. A6.2.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. A8.2's guidance states that Windows Defender is suitable, provided it is set to update in line with Microsoft's guidelines and prevent malware from running on detection.
The antimalware platform or engine version shown in Windows Security or your management console. The point is to show the product is current and updating.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh