Malware protection: the control you’ve probably already paid for
Nothing in this section needs buying. Windows ships with Defender, Macs ship with their own protection, and phones meet the control through the app store they already use plus a short list of apps you approve. The A8 questions are really asking one thing: is what you already have switched on, everywhere?
What the control requires
Every in-scope device needs at least one of two mechanisms (A8.1). The first is anti-malware software that keeps itself updated, is set to prevent malware running, and warns you about — or blocks — known-malicious websites (A8.3). The second is application allow-listing: users can only install signed apps (an official store on a device that isn’t jailbroken or rooted, A8.4) and only the apps your business has approved, from a list you keep up to date (A8.5). One mechanism per device is enough; you don’t need both.
Windows: Defender counts
Windows Defender is built in, free, and meets the requirement. Check it is actually on: click Start, type “Windows Security”, open it, then “Virus & threat protection” — “Real-time protection” should be on under the settings. If a third-party antivirus was installed years ago and its licence lapsed, that machine may be worse off than with Defender alone: expired security software neither protects nor updates, so remove it and let Defender take over. Web protection — the warn-or-block behaviour A8.3 asks about — comes from Defender’s SmartScreen and from the browsers themselves, which flag known-bad sites by default.
Macs: built-in protection plus a setting worth checking
Macs include built-in malware protection (XProtect). The question set doesn’t name it, so check the IASME Knowledge Hub’s current position before relying on it alone; the alternatives are anti-malware software, or allow-listing with a list of approved apps. Turn on Safari’s fraudulent-website warning for A8.3. And keep System Settings → Privacy & Security → “Allow applications from” on “App Store” or “App Store & Known Developers” — not “Anywhere”. If someone changed it to install one tool years ago, set it back. The Mac guide covers the rest of the Mac settings.
Phones and tablets: the app store is the mechanism
You don’t install antivirus on phones for Cyber Essentials. iPhones and iPads only install from the App Store by design; Android devices should keep installation from unknown sources blocked. The other half of the answer is that devices are not jailbroken or rooted (A8.4) — breaking a device out of its store model breaks the allow-listing the control relies on, and there is no quick fix except restoring the device. Allow-listing also means only apps your business has approved: keep a short list of approved work apps and make sure people install only those (A8.5). A list in your BYOD policy is enough; device management software is optional. This applies to in-scope personal phones under the BYOD rule too.
Answering the questions
- A8.1 — how are devices protected? Name the mechanism per device type: “Defender on all Windows laptops; official app stores plus our approved-apps list on phones” — and whichever mechanism your Macs use. One true sentence like that is the shape of a good answer.
- A8.2 — is the anti-malware kept up to date and set to stop malware running? Defender updates itself; check real-time protection is on.
- A8.3 — malicious websites? Defender/SmartScreen and modern browsers warn or block by default — say so, and don’t switch those warnings off.
- A8.4 — unofficial apps? Confirm store-only installs and no jailbroken or rooted devices. If you can’t vouch for a device, that’s a conversation before it’s an answer.
- A8.5 — approved apps? Where you rely on app stores, keep a list of the apps your business has approved and make sure people install only those — in-scope personal devices included.
Sweep every device once — the same afternoon as the secure-configuration pass — and tick the section off in the checklist.
What this control is not
It isn’t an endpoint-detection procurement exercise, it doesn’t require a particular brand, and it doesn’t ask for email filtering, sandboxing or a security operations centre. The scheme’s bar is deliberate: one working, self-updating protection mechanism on every device. Clear that honestly and move on to the sections that actually fail businesses — MFA, updates within 14 days and unsupported software.
Frequently asked questions
Do I need to buy antivirus for Cyber Essentials?
Usually not. Windows Defender is built in, free and counts. Macs include built-in protection — check IASME’s current position before relying on it alone, or use allow-listing with an approved-apps list. Phones and tablets meet the control by using only official app stores, and only apps your business has approved, on devices that aren’t jailbroken or rooted.
What does the malware control actually require?
At least one mechanism per device: anti-malware software that updates itself, prevents malware running and warns about or blocks known-malicious websites — or application allow-listing, where users can only install signed apps (such as from an official app store) and only those on a list of approved apps your business keeps up to date (A8.4, A8.5).
Does Cyber Essentials require antivirus on phones?
No. On phones and tablets the usual mechanism is application allow-listing: the official app store on a non-jailbroken, non-rooted device, plus a list of approved apps that people install from (A8.5).
Is a paid antivirus better for the assessment?
The assessment doesn’t score brands. What matters is that a qualifying mechanism is on, updating itself, and active on every in-scope device — built-in tools meet that as well as paid ones.