Cyber Essentials malware protection requirements (v3.3, 2026)
Cyber Essentials malware protection: anti-malware software that updates, blocks malicious code and websites, or application allow listing with code signing. Covers A8.1 to A8.5 and CE Plus test 3.
Every in-scope device needs either anti-malware software that updates automatically, blocks malicious code and blocks malicious websites, or application allow-listing where only signed, approved applications can run. One of the two is mandatory on every server, desktop, laptop, tablet and phone in scope.
- Aim
- To restrict execution of known malware and untrusted software, from causing damage or accessing data.
- Applies to
- Servers, desktop computers, laptops, tablets, mobile phones, IaaS, PaaS, SaaS
- CE Plus test
- Test case 3: Check malware protection
- What changed in 2026
- No change to the requirement in v3.3. A8.1 now lets applicants select both option A and option B, because most organisations with laptops and smartphones use anti-malware on the computers and allow listing through app stores on the phones. Option C requires a notes description.
What does Cyber Essentials require for malware protection?
The Cyber Essentials malware protection control is the requirement that every in-scope device runs an active malware protection mechanism, either anti-malware software or application allow listing, to stop known malware and untrusted software from running.
Malware such as viruses, worms and ransomware arrives by email attachment, by download (including from application stores) and by direct installation. The control aims to stop it being delivered and to stop it running.
The control applies to servers, desktop computers, laptops, tablets, mobile phones, IaaS, PaaS and SaaS. For each device you must use at least one of the two options below, and the software must be active and kept up to date in line with the vendor's instructions.
Which malware protection option do I need on each device?
You must make sure that a malware protection mechanism is active on all devices in scope. For each device, you must use at least one of the options listed below.
Option A, anti-malware software, is the option for in-scope devices running Windows or macOS, including servers, desktop computers and laptops. Option B, application allow listing, is an option for all in-scope devices and is the usual answer for iOS and Android, where the app store and MDM restrict what can be installed. Most organisations select both in A8.1.
QuestionsA8.1
How must anti-malware software be configured?
be updated in line with vendor recommendations; prevent malware from running; prevent the execution of malicious code; prevent connections to malicious websites over the internet
Four settings: updated in line with vendor recommendations, prevents malware from running, prevents the execution of malicious code, and prevents connections to malicious websites over the internet. A8.2 covers updates and blocking on detection; A8.3 covers scanning web pages and warning about malicious sites; its guidance says the anti-malware software or the browser can provide this. The A8.2 guidance confirms that Windows Defender is suitable, and A8.3 names Microsoft Defender SmartScreen for web protection on Windows 11. The Microsoft Defender for Business setup guide covers the settings.
What does application allow listing require?
Only approved applications, restricted by code signing, are allowed to execute on devices.
Two things: you actively approve applications before deploying them, and you maintain a current list of approved applications. Users must not be able to install any application that is unsigned or has an invalid signature. A8.4 asks whether users are restricted from installing unsigned applications; its guidance notes that Windows, Chromebooks, mobile phones and tablets can restrict this, and that a device usually has to be rooted or jailbroken to allow unsigned apps. A8.5 asks whether you keep the approved list and make sure users only install from it, including on employee-owned devices. Mobile device management is the easy way to do this but the guidance says it is not mandatory if policy, process and training achieve the same result. The iOS and iPadOS and Android setup guides show the app restrictions to enforce.
How does Cyber Essentials Plus test malware protection?
Cyber Essentials Plus tests malware protection through Test case 3: Check malware protection in the Test Specification v3.2. The steps, paraphrased:
- For each sampled device the assessor identifies whether it relies on anti-malware software or application allow listing.
- Anti-malware devices: the assessor confirms the software is installed and running, then either sends approved test files by email and browser download (sub-tests 3.1.1 and 3.1.2) or performs manual checks (3.1.3).
- If a test file downloads and the user is not blocked from accessing it, or an executable runs without an extra prompt, the sub-test fails.
- Allow-listing devices (sub-test 3.2): the trusted root certificate list must be the OS vendor's standard set or a subset, extra roots only with your explicit agreement, and unsigned or untrusted executables must not run.
Who is responsible for malware protection in cloud services?
For IaaS you install and maintain anti-malware on your own virtual machines. For PaaS the provider usually handles it, sometimes with your involvement. For SaaS the provider implements the control; check their trust centre for the commitment.
| Requirement | IaaS | PaaS | SaaS |
|---|---|---|---|
| Firewalls | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
| Secure Configuration | Both your organisation and the cloud provider | Both your organisation and the cloud provider | Both your organisation and the cloud provider |
| Security Update Management | Both your organisation and the cloud provider | Both your organisation and the cloud provider | The cloud provider |
| User Access Control | Your organisation | Your organisation | Your organisation |
| Malware Protection | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
The applicant is always responsible for ensuring all controls are implemented. Where the provider implements one on your behalf, the commitment must be in contractual clauses or documents referenced by contract. See cloud services scope.
Which questions cover malware protection?
5 Danzell questions cover malware protection, A8.1 to A8.5. None of them is an automatic fail, but a non-compliant answer is returned by the assessor. Each links to the exact wording and a model answer.
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Conditional: shown after an earlier answerMultiple choice + notes
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
How do assessors check malware protection?
Related requirements
- Previous control: User Access ControlEnsure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- Malware protection questions A8.1 to A8.5Every A8 question explained
- CE Plus test 3: malware protection testsThe test files and manual checks
- Security update managementAnti-malware must also be supported software
- BYOD scopeAllow listing on employee-owned devices
- Glossary: allow listingThe definition and how it is tested
- Microsoft Defender for Business setup guideSettings that satisfy A8.2 and A8.3
- Cyber Essentials checklistEvery requirement as a row with the evidence to gather
- Check your readinessTest your answers against the auto-fail questions first
Frequently asked questions
Yes. The A8.2 guidance states that for the avoidance of doubt Windows Defender is suitable for this purpose. It must be active, updating in line with Microsoft's recommendations, blocking malware on detection and, with SmartScreen or equivalent, preventing connections to malicious websites.
No. Mobile devices normally meet the control through option B, application allow listing: only signed apps from the app store, an approved list of applications, and users prevented from installing unsigned apps. A8.4 and A8.5 cover this, and MDM makes it easy to evidence.
Yes, servers are named in the applies-to list, and every in-scope server needs one of the two mechanisms. The requirements describe anti-malware software as the option for Windows and macOS devices including servers, and application allow listing as the option for all devices, so for a Linux server describe the mechanism you use and confirm it with your assessor. CE Plus test case 3 samples servers that provide a user-interactive desktop and IaaS instances.
Yes. The A8.2 guidance says you can use any commonly used anti-malware product, whether free or paid-for, as long as it meets the requirements: updating in line with the vendor's guidelines and preventing malware from running on detection. It must also be a supported product, so list it with its version in A6.2.2.
A control where only approved applications, restricted by code signing, are allowed to execute. You approve applications before deployment, keep a current list, and make sure users cannot install anything unsigned or with an invalid signature. App stores with MDM restrictions are the common implementation on phones and tablets.
Test case 3. On anti-malware devices the assessor sends approved test files by email and downloads them through the browser; any file that reaches the user unblocked, or any executable that runs without an extra prompt, is a fail. On allow-listing devices the assessor checks the trusted root list and that unsigned executables will not run.
No. Endpoint detection and response is not required. The A8.2 guidance says any commonly used anti-malware product, free or paid-for, is acceptable if it updates in line with the vendor's guidelines and prevents malware from running on detection. An EDR product that also meets those settings and blocks malicious websites satisfies option A.
An anti-malware console or device management report listing every Windows and macOS device with real-time protection on and current definitions (A8.1, A8.2), the web protection or SmartScreen setting (A8.3), and for phones and tablets the approved application list and the policy that blocks unsigned or unapproved apps (A8.4, A8.5). List the product and version in A6.2.2.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Mitigating malware and ransomware attacksRead on ncsc.gov.uk (opens in a new tab)