CIS Control 10 covers stopping or containing malicious applications, code and scripts on enterprise assets: anti-malware deployment, signature updates, removable media, anti-exploitation features, central management and behavior-based detection.
Putting anti-malware software on every enterprise asset and keeping it maintained: the coverage baseline for Control 10, distinct from the signature, central management and behavior-based safeguards that refine it.
Configuring anti-malware signature files to update automatically on all enterprise assets, so protection does not depend on manual updates; an IG1 safeguard alongside 10.1 and 10.3.
Turning off autorun and autoplay auto-execution for removable media, a configuration setting rather than a tool; the IG1 removable media safeguard that 10.4 later extends with automatic scanning.
Configuring anti-malware software to scan removable media automatically: the IG2 step beyond simply disabling autorun (10.3), and how assessors check it on endpoints.
Turning on operating system and software anti-exploitation features where possible, such as data execution prevention and exploit guard settings; the only Control 10 safeguard focused on exploit mitigation rather than malware detection.
Managing anti-malware software from a central console so policy, status and detections are visible across the fleet; the IG2 management layer over the per-asset deployment in 10.1.
Using anti-malware software that detects threats from behavior rather than signatures alone; the IG2 detection upgrade within Control 10 and the evidence that shows it is active.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.