This policy procedure sets out the malware protection rules every computer and user must follow, from scanning settings to reporting a suspected infection to IT.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on malware protection:

• Malware, Anti-Malware and Patching
• ISO 27001 Annex A 8.7 - Protection Against Malware
• Cybersecurity
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help putting malware protection and scanning settings in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Anti-Malware Policy Procedure Template

The Anti-Malware Policy Procedure is a Word template that sets out how a business protects its information assets from malware. It covers risk assessment of malware threats and the rules for protection software on company and non-company devices, on-access and daily scanning, web filtering, infected devices, email attachments and software from internet sources.

It applies to all employees and company activities, and breaches can lead to disciplinary action. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of protecting information assets from malware, the activities and staff covered, and disciplinary action for breaches
• Management of malware risks - periodic risk assessments of malware threats and gaps in protection, with findings actioned and the policy kept in line with current controls
• Protection software on devices - approved anti-malware with automatic updates on company computers, servers and tablets, and a suitable product on any non-company device
• Scanning and web filtering - on-access scanning of downloads, files and removable or remote storage, scans at least daily, and blocking of known malicious websites
• Infected devices and reporting - never disabling protection software, investigating warnings that it is disabled, disconnecting suspected infected devices and reporting incidents to IT
• Email attachments and installed software - scanning of email attachments before delivery, checks on software from internet sources and no installing of applications from unsolicited sources

Built for Everyday Malware Protection

• Approved anti-malware required on every computer and server connected to the company network
• Protection software configured for on-access scanning and scans run at least daily
• Users blocked from known malicious websites by protection software or content filtering
• The company may keep a device off the network until an infection is removed
• Creating or distributing malicious code on company systems is prohibited

Who Needs an Anti-Malware Policy Procedure?

Any business whose staff use computers, tablets or the company network, and the person or IT team who sets up and supports its protection software.

Using the Policy

Adjust the scanning frequency, web filtering and IT support arrangements to match your own systems, then name the person in the Controlled By field. Give it top level approval and brief staff on what to do if they suspect an infection.

Related Documents

GG-8-03 Software and Malware Guidance and TT-8-03 Software and Malware Training Talk help managers and staff put the malware protection rules into practice.

Third Party and Non-Company Devices

Any device not owned by the company must run an appropriate anti-malware product, for example where a third party needs access to company systems as part of a project or contract. Users who have difficulties with a recommended product should request technical support from IT.