What it asks for. This control expects protection against malware to be implemented and supported by appropriate user awareness. Its purpose is to make sure information and other associated assets are protected against malware.
In practice. Good practice combines technical measures, such as endpoint detection and response, email and web filtering, application control and timely patching, with awareness of how malware arrives. Protection is deployed across endpoints and servers, kept current and monitored. Auditors look for coverage reports, configuration, alert handling and awareness content.
Common gaps. Typical gaps are endpoints without protection or with outdated agents, exclusions set too broadly and reliance on signatures without behavioural detection. Awareness is often generic and does not cover current delivery methods such as malicious links in collaboration tools. Systems that cannot run agents, such as OT or appliances, are often unprotected.