Cyber Essentials malware protection explained (v3.3)

Malware protection is one of the five technical controls in Cyber Essentials, alongside firewalls, secure configuration, security update management and user access control.¹ It is also the control people tend to assume they have covered ("we've got antivirus") and then find gaps in during assessment: the old laptop with protection switched off, the Mac nobody thought about, the phone that sideloads apps.

This guide walks through what version 3.3 of the requirements says, published by the NCSC in April 2026, what counts as compliant on each type of device, and how Cyber Essentials Plus checks it. It is written for the person who has to fill in the questionnaire, which in a lot of small businesses is the office manager rather than an IT specialist.²

What the v3.3 requirement actually says

The aim of the control, in the NCSC's words, is "to restrict execution of known malware and untrusted software, from causing damage or accessing data".¹ It applies to servers, desktops, laptops, tablets, mobile phones and cloud services (IaaS, PaaS and SaaS).

The core requirement is short. You must make sure a malware protection mechanism is active on all devices in scope, using at least one of the listed options for each device. Whatever you use must be active, kept up to date in line with the vendor's instructions, and configured to work as the requirements describe.¹ The document also points out that in most modern products these options are already built in, and that buying from a third party is an alternative, not an obligation.

There are two options in v3.3:

That table is a summary of the NCSC wording.¹ If your assessor asks a question you are unsure about, go back to the source document rather than a summary, including this one.

The four things anti-malware must do

Most UK SMEs will use the anti-malware option for their Windows and Mac machines, so it is worth being precise about the four configuration points:

1. Updated in line with vendor recommendations. Signature or model updates must be happening automatically. A machine that has not checked in for months fails this, even if the software is installed.
2. Prevent malware from running. Real-time or on-access protection must be on, not just scheduled scans. A product that only reports malware after the fact is not enough.
3. Prevent the execution of malicious code. This goes beyond known bad files and covers things like malicious scripts and macros.
4. Prevent connections to malicious websites. Web protection must be on. This can come from the endpoint product itself, the browser, or a web filter, but it has to be in place on the device.

Which devices are in scope

The malware control applies to everything inside your Cyber Essentials scope, so scope decisions matter.

• End-user devices must be included. A scope that does not include end-user devices is not acceptable.¹
• Cloud services cannot be excluded. If your data or services are hosted in the cloud, those services are in scope. For SaaS such as Microsoft 365, malware protection is largely the provider's responsibility, but you need to understand and configure what is yours to configure.
• Staff-owned devices (BYOD) count if they access organisational data or services. Devices used only for native voice calls, native text messages or MFA apps are out of scope.¹
• Home and remote working devices used for your organisation's business are in scope by default, whether corporate or BYOD.¹

The NCSC encourages whole-organisation scope, saying it gives the best protection and maximises customer confidence.¹ There is a practical reason too: UK organisations with turnover under £20m that certify their whole organisation can opt in to free cyber liability insurance through IASME.³

Device by device: how to meet the control

Windows PCs and laptops

Microsoft Defender Antivirus is built into Windows and, when switched on, updating and configured with real-time and web protection, can meet the anti-malware option. A paid endpoint product (Microsoft Defender for Business, CrowdStrike Falcon, or others) also meets it, as long as the configuration points above are covered.

Common failures: a third-party antivirus whose subscription lapsed, leaving neither it nor Defender fully active; protection disabled by a user with local admin rights; and machines that sit in a drawer for months and come back with stale updates.

Macs

Macs are listed explicitly under the anti-malware option.¹ Apple's built-in protections are real, but you will need to show your assessor how the four configuration points are met. Many organisations simply put the same endpoint product on Macs that they use on Windows, which keeps reporting in one place.

Phones and tablets

The anti-malware software option is listed for Windows and macOS devices, while application allow listing is the option for all in-scope devices.¹ In practice, iPhones, iPads and Android devices normally meet the control through allow listing: apps only come from the official store, they are signed, and sideloading or installing from unknown sources is blocked. A mobile device management tool such as Intune makes this much easier to prove.

Servers and cloud virtual machines

Windows servers and IaaS virtual machines with a desktop need protection like any other Windows device. Linux servers are not covered by the anti-malware option as worded in v3.3, so check with your Certification Body how they expect you to meet the control for those, and keep the conversation in writing.

Kiosks, shared PCs and odd devices

Reception PCs, meeting room devices and shop floor machines are easy to forget. If they connect to the internet and are in scope, they need protection. A quick asset list helps: asset management is not a Cyber Essentials control in its own right, but the NCSC says good asset management helps you meet all five.¹

How Cyber Essentials Plus tests it

Basic Cyber Essentials is a self-assessment questionnaire. Cyber Essentials Plus adds hands-on testing by an assessor, and malware protection has its own test case.⁴

The assessor samples devices and identifies which form of protection each one uses. For devices using anti-malware software, the test specification includes:

• Malware by email. The assessor sends test files from an external account and watches a user try to open them. If a malware test file arrives and the user is not blocked from accessing it, or an executable runs without a prompt needing further user interaction, that is a fail.⁴
• Malware by browser. The user tries to download test files from an approved external website. The same pass and fail logic applies.⁴
• Manual checks. Where test files do not prove correct configuration, the assessor checks logs to confirm the software is installed and operational and is being updated as the vendor intends.⁴

Devices using application allow listing have a separate sub-test that looks at trusted root certificates and whether unsigned executables can run.⁴

The test specification in force at the time of writing is v3.2, dated April 2025.⁴ Your Certification Body will tell you which version they test against.

A practical checklist before you submit

Work through this before you start the questionnaire, or before the assessor arrives for Plus:

1. List every device in scope, including Macs, phones, tablets, servers, home-working laptops and staff-owned devices that access company data.
2. Confirm one protection option per device. Windows and Mac: anti-malware. Phones and tablets: allow listing via the official app store and MDM.
3. Check protection is actually active, not just installed. Look at your console or Windows Security on each machine. Remove expired third-party products so they do not block the built-in one.
4. Check updates are current. Find devices that have not checked in recently and either bring them up to date or retire them.
5. Check web protection is on, whether from the endpoint product, browser or filter.
6. Remove local admin rights from day-to-day accounts, so users cannot switch protection off. This also helps with the user access control requirement.
7. Run a harmless test. The EICAR test file is a standard, harmless file designed for checking that anti-malware software reacts.⁵ Do this with your IT provider if you are unsure.
8. Keep evidence: a screenshot or report from your console showing devices, status and last update.

Where Cyber Essentials stops

Cyber Essentials is a baseline, and a worthwhile one. Only 12% of small businesses hold it,² and for some central government contracts, especially those handling personal information or OFFICIAL data, suppliers are expected to have it.⁶

But the malware control is about blocking known bad things from running. It does not ask you to detect an attacker who is already inside using legitimate tools, to investigate an alert, or to have anyone watching at 3am. That is the gap endpoint detection and response (EDR) and managed services fill. Our guide What is EDR, and does a small business need it? explains the difference, and what UK cyber insurers ask about EDR, MFA and backups covers why many insurers now expect more than the baseline.

If you are already on Microsoft 365 Business Premium, Defender for Business is included and is a good product.⁷ If you want CrowdStrike Falcon instead, our Cyber Essentials page explains how it maps to the control, and replacing your old antivirus covers making the switch cleanly.

Common questions