What it asks for. Organisations should prevent or control the installation, spread and execution of malicious code on their assets. This includes centrally managed anti-malware, automatic updates and protections against common delivery methods such as removable media and autorun.
In practice. Endpoint protection or EDR is deployed on all supported endpoints and servers, managed centrally and updated automatically, with behaviour based detection enabled. Autorun is disabled, removable media is scanned or restricted, and exploit protection features of the operating system are turned on. Auditors expect deployment coverage reports, evidence that agents are healthy and current, and records of how alerts are triaged.
Common gaps. Coverage gaps on servers, Linux systems and unmanaged devices are common, as are agents that are installed but outdated or in a passive mode. Alerts are sometimes generated with nobody responsible for acting on them.