Deploy and Maintain Anti>Malware Software
Description
Deploy and maintain anti-malware software on all enterprise assets.
Implementation Checklist
Tool Recommendations
Cloud-native endpoint protection platform with next-gen AV, EDR, threat intelligence, and managed hunting
CrowdStrike · Per-endpoint subscription
Enterprise endpoint security with threat prevention, EDR, automated investigation, and attack surface reduction
Microsoft · Per-device subscription (P1/P2)
AI-powered endpoint protection with autonomous response, EDR, and XDR capabilities across endpoint, cloud, and identity
SentinelOne · Per-endpoint subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Commodity Malware Infection Across Unprotected Endpoints
AvailabilityWithout anti-malware software deployed, enterprise assets are vulnerable to commodity malware including ransomware, banking trojans, information stealers, and cryptominers that are routinely blocked by even basic AV solutions.
Ransomware Encryption of Enterprise Data
AvailabilityRansomware variants like LockBit, BlackCat, or Cl0p execute and encrypt data on systems without anti-malware protection, causing operational disruption and potential data loss because no software exists to detect or prevent the encryption process.
Information Stealer Deployment for Credential Harvesting
ConfidentialityInformation-stealing malware (RedLine, Raccoon, Vidar) executes on unprotected endpoints, harvesting saved browser credentials, session cookies, cryptocurrency wallets, and VPN configurations for sale on dark web marketplaces.
Vulnerabilities (When Safeguard Absent)
No Anti-Malware Software Deployed on Enterprise Assets
Some or all enterprise assets lack anti-malware software, providing no automated defense against known malware families, exploit payloads, or malicious scripts that endpoint protection would normally detect and block.
Inconsistent Anti-Malware Coverage Across Asset Types
Anti-malware is deployed on Windows workstations but not on servers, Linux systems, macOS devices, or virtual machines, leaving significant portions of the infrastructure without malware detection capabilities.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Anti-malware deployment status and detection statistics | Monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |