This guidance sets out the rules on installing software, licensing and malware protection, and what to do if a device may be infected.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on malware and cyber security:

• Malware, Anti-Malware and Patching
• Phishing, Email and Social Engineering
• Cybersecurity
• Information Security knowledge base

How to Download

These files are included in the alphaZ subscription. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Need Help Implementing?

If you'd like hands-on help putting your software controls and malware protection arrangements in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Software and Malware Guidance

A general guidance document on software and malware, for everyone who uses company computers, phones and other devices. It covers how software installation is controlled, how software is developed and changed, licensing, the rules for malware protection and what users must do if they suspect an infection.

Topics Covered

• Software and malware - what counts as software, how it can affect a device, and what anti-malware software does
• Installing software - using only approved software, keeping systems patched, getting approval before installing and never disabling security software
• Developing and changing software - a defined development process, with testing in a separate environment and change control before release
• Software licensing - making sure all software is licensed and never installing unlicensed software on a company device
• Malware protection rules - anti-malware on every connected device, including third-party devices, daily scans, blocked websites and scanned email attachments
• What users should do - reporting anti-malware problems, disconnecting a suspected infected device and checking downloads and attachments are genuine

Who Is It For?

Everyone who uses company computers, tablets, phones or other devices, and anyone who installs, develops or manages software for the company.

Included in the ISO 27001 and ISO 22301 Toolkits

This guidance is supplied with the TT-8-03 Software and Malware training talk, which is part of the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Using the Guidance

Issue it at induction to everyone given a company device, go through it with the matching training talk, and keep it as a reference for IT staff. Record who has received it, for example on the training matrix.

Controlling Software Installation

Software installation is controlled because unauthorised software may not be correctly licensed, which can lead to fines, or could compromise systems by carrying malware or conflicting with the operating system. The guidance limits company devices to approved software, keeps everything patched, needs approval for anything extra and stops users removing or switching off security software.

Adapting the Guidance

Edit the guidance to match your own arrangements - your approved software list, who approves software installation, how users contact IT, and your development and change control process.

Related Documents

Other documents that work alongside this guidance:

• PP-8-02 Anti Malware Policy Procedure
• PP-8-03 Software Policy Procedure
• PP-8-07 Technical Vulnerability Management Policy Procedure
• P-38 Software Installation Policy
• GG-8-01 Information Security General