What it covers. NIST guidance on preventing malware incidents and responding to them when they occur, focused on desktops and laptops. It covers awareness, vulnerability mitigation, threat mitigation tools and defensive architecture, then the incident handling steps of detection, containment, eradication and recovery.
In practice. Organisations combine hardening, timely patching, endpoint protection, application control and user awareness to reduce infection, and maintain procedures for analysing and containing infected hosts. Response planning covers isolation, identification of the malware and affected systems, and safe restoration. Evidence includes endpoint protection coverage, response procedures and incident records.
Common gaps. Common gaps are relying on antivirus alone, incomplete endpoint coverage and reimaging hosts without understanding how the infection occurred. Lessons from malware incidents are also seldom fed back into hardening or awareness.