What a CIS malware defense policy template must cover
Your customer, contract or regulator has asked for CIS Controls alignment, and the malware defense policy is missing. The Center for Internet Security publishes a free IG1 policy template for Control 10 (Malware Defenses), and it supports Safeguards 10.1 to 10.3. Those three Safeguards form the essential baseline: install and maintain anti-malware software on every enterprise asset, configure automatic signature updates, and disable autorun and autoplay for removable media. Control 10 has seven Safeguards in CIS Controls v8.1, so the template covers three of them and leaves the other four for your own drafting.
The template does not address the four IG2 Safeguards, 10.4 to 10.7, which add central management of anti-malware, behavior-based detection, anti-exploitation features and related requirements. If your environment is in scope for IG2, your policy must extend the template to cover those Safeguards, and you should confirm the exact wording of each against the CIS Controls v8.1 page. The organization owns the policy, the controls it describes and the decisions behind them, including who approves exceptions for assets that cannot run an agent.
Treat the template as a starting point for the written process, not as evidence. An assessor will look for the policy, then for proof that it runs: the anti-malware deployment list, update configuration settings and removable media settings for the assets in scope. Before you adopt the template, confirm which asset classes and systems are in scope, name an owner for each Safeguard, and decide how often the policy will be reviewed. The Control 10 page of the CIS Assessment Specification describes the measures used to verify each Safeguard, so read it alongside the template.
Which Control 10 evidence an assessor will ask to see
An assessor testing Control 10 works from the Safeguards outward: coverage, update settings, removable media behavior and the written process. The cards below group the evidence by area, and each one should be traceable to a specific Safeguard in the Control 10 assessment specification.
Anti-malware coverage reports
Safeguard 10.1 asks for anti-malware software on all enterprise assets and for it to be kept maintained. An assessor will compare an export from your endpoint management or anti-malware console against your asset inventory from Control 1, looking for devices that are missing the agent, have it disabled or are not reporting. Export the report with a date and the asset list so the comparison can be repeated. Confirm how the current assessment measures coverage, since the exact inputs are defined in the Control 10 CAS page.
Signature update configuration
Safeguard 10.2 asks for automatic updates of anti-malware signature files on all enterprise assets. Show the policy or configuration object that sets the update schedule and source, along with a sample of endpoints showing the current signature version and last update time. Assessors look for updates that run on their own rather than on manual action, and for gaps where a device has not updated for an extended period.
Autorun and autoplay settings
Safeguard 10.3 asks you to disable autorun and autoplay for removable media. Evidence is usually a group policy, configuration profile or endpoint setting applied across the fleet, plus a compliance report showing which devices have it in effect. Test a sample of workstations and servers yourself before the assessment, because a setting that is defined in a template but not applied to some devices will fail the check.
Central management and behavior detection
Safeguards 10.6 and 10.7 are IG2 additions covering central management of anti-malware and behavior-based detection. Evidence includes the management console configuration, the list of enrolled devices, and alert or detection settings that show behavior-based analysis is enabled. Organizations that only meet IG1 may not need these items yet, but any organization that claims IG2 coverage should be able to show them.
Documented malware defense process
Assessors expect a written process that states who owns anti-malware, how deployment and signature updates are checked, how exceptions are approved and how detections are escalated. The document should be approved, dated and reviewed on a schedule, and it should match what the consoles actually show. Use the CIS malware defense policy template as the starting point, then add the operational details your environment needs.
Confirming the current measures
The CIS Controls Assessment Specification defines what to measure for each Safeguard, including inputs, operations and metrics, but it does not prescribe how to measure. Read the current Control 10 page before you collect evidence, because measures and wording can change between versions. Record which version of the specification you used so your evidence file can be defended later.
IG1 baseline versus IG2 additions for malware defense
Implementation Group 1 defines essential cyber hygiene and a minimum standard for every enterprise. For Control 10, that baseline is three Safeguards: 10.1 asks the enterprise to install anti-malware software on all enterprise assets and keep it maintained, 10.2 asks for automatic updates of anti-malware signature files on those same assets, and 10.3 asks the enterprise to disable autorun and autoplay for removable media. The CIS policy template for malware defense is written to support these three Safeguards and nothing beyond them.
- Coverage of enterprise assets: the policy should name the asset classes in scope and state that every enterprise asset is covered, with a documented exception path for any asset that cannot run the agent.
- Signature update cadence: the policy should require automatic signature updates and name who verifies that updates are applied.
- Removable media rule: the policy should state that autorun and autoplay are disabled and identify who may override the rule.
- Maintenance and ownership: the policy should name an owner for the anti-malware tooling and the review frequency for the policy itself.
For an illustrative small enterprise, the policy can fit on a few pages. Confirm with the assessment specification for Safeguard 10.1 which evidence it expects before you finalize the wording.
IG2 adds Safeguards for enterprises with more operational complexity that often hold sensitive information. Control 10 gains four Safeguards at that level: 10.4 covers anti-exploitation features, 10.5 covers anti-exploitation features as an additional layer, 10.6 covers central management of anti-malware software, and 10.7 covers behavior-based anti-malware detection. The IG2 tab is where the policy stops being a tool setting and becomes an operating process with named reviewers and recorded decisions.
- Central management: the policy should require that anti-malware is managed from a central console, so that configuration, health and alerts are visible in one place.
- Behavior-based detection: the policy should require detection beyond signatures, with a named owner for tuning the rules.
- Alert review: the policy should name who reviews malware alerts, how often, and the escalation path to incident response.
- Exception records: the policy should require that every exception to a block, quarantine or update rule is documented, approved and time-limited.
IG2 policies are written for organizations that have the staff to review alerts continuously. Ask whether your team can staff that review before you commit to the IG2 wording.
The operational changes at IG2 fall on specific roles. The security team usually owns alert triage and exception approval, the platform team runs the central console and update pipeline, and application owners are asked to report false positives that block business software. Each role should appear in the policy so an assessor can trace a detection from the console to a named person and a recorded decision.
- Alert triage owner: name the role that reviews behavior-based alerts and the hours or shifts it covers.
- Exception log: record the asset, the reason, the approver, the expiry date and the compensating control for each exception.
- Tuning review: schedule periodic review of detection rules so that noisy rules are adjusted rather than silently disabled.
- Incident handoff: define when a malware alert becomes an incident and which Control 17 process picks it up.
- Console access: restrict who can change central policies and log those changes.
These costs are mostly staff time and tooling, and they recur every year. Ask any implementation partner to show, in the written scope, which of these roles it will set up and which your team must staff.
Use the IG1 tab if your enterprise is starting its CIS Controls program or needs a minimum policy that covers all enterprise assets. Use the IG2 tab if you hold sensitive information, run a more complex environment, or have already met the IG1 Safeguards and need central management and behavior-based detection. The two tabs are not alternatives: IG2 Safeguards build on the IG1 baseline, so an IG2 policy must still contain everything in the IG1 policy.
- Start with IG1 coverage: confirm that all enterprise assets are inventoried and covered before adding IG2 elements.
- Check the staffing: confirm who will review alerts and approve exceptions before writing IG2 commitments.
- Match the tooling: confirm that your anti-malware product supports central management and behavior-based detection before you commit to 10.6 and 10.7.
- Record the scope: note which assets are excluded and why, so the exclusions can be tested.
- Review yearly: schedule a review of the policy against the CIS Controls Navigator and the assessment specification.
Before you rely on either tab, check the wording of each Safeguard in the CIS Controls v8.1 materials and confirm the implementation details with your anti-malware vendor.
How to adopt the malware defense template in four phases
The sequence turns the CIS malware defense template into a working policy, configured controls and a body of evidence that an independent assessor can test. Each phase closes with a named output, so the organization knows when it can move to the next one.
Confirm scope and asset inventory
The security lead and the IT operations owner define which enterprise assets the policy covers, including endpoints, servers, virtual machines, cloud workloads and any removable media in use. They reconcile this list against the asset inventory maintained under CIS Control 1, because Safeguard 10.1 applies to all enterprise assets and a gap in the inventory becomes a gap in the policy. The output is a signed scope statement with a list of in-scope asset classes and named owners for each. The step is complete when the inventory exceptions are documented and approved, not when the list looks tidy.
Adapt the CIS template to your environment
The policy owner takes CIS's IG1 malware defense template and fills in the organization's own details: approved anti-malware products, who manages them, how signature updates are scheduled, the autorun position for removable media, and who may grant exceptions. Legal, HR and the operations leads review the draft because the wording must match existing acceptable use and change management rules. The output is an approved policy version with a named owner and a review date. Confirm with the policy owner that the wording covers IG2 items only if the organization has chosen to adopt them, since the template itself addresses IG1 Safeguards.
Implement controls and configure the platforms
Platform engineers deploy the chosen anti-malware software to every in-scope asset, configure automatic signature updates, and disable autorun and autoplay for removable media through the endpoint management or hardening baseline. Where the organization pursues the IG2 additions, they also set up central management and evaluate behavior-based detection. Open-source self-hosted platforms can run parts of this stack inside the client's infrastructure, but the organization must confirm each capability with the vendor before relying on it. The output is a configuration record per asset group, with the settings exported or screenshotted for the assessment file.
Collect and retain evidence
The control owner gathers the artifacts an assessor will ask for: the approved policy, the deployment report showing anti-malware coverage against the asset inventory, update logs showing signature currency, the autorun configuration, and records of exceptions and their approvals. Evidence is dated and tied to a specific asset or group so that it can be sampled. The owner runs a sample check on a handful of assets to confirm the reports match reality. The output is an evidence index that maps each artifact to its Safeguard, with a clear owner and collection date for each item.
Test the controls before the assessment
An internal reviewer or an implementation partner walks through the control against the CIS Assessment Specification for Safeguards 10.1 to 10.3, checking the same inputs and measures the assessor will use. They look for assets missing anti-malware, out-of-date signatures, removable media still set to auto-execute, and policy text that no longer matches the running configuration. Findings are logged with an owner and a fix. The output is a readiness record showing which Safeguards pass, which need remediation and what was changed. Repeat the test after fixes, not only once.
Hand the policy and evidence to an independent assessor
The organization provides the approved policy, the evidence index and the readiness record to an independent auditor, assessor or certification body if its customers, contracts or regulators require a formal result. DeployOpen prepares systems, controls and evidence, but it does not issue audit reports, attestations or certifications, and only the independent assessor makes that determination. The organization owns the outcome and answers the assessor's sampling requests. The output is the assessor's own report or statement, which the organization retains and shares as required. Ask the assessor to confirm in writing which framework and Safeguard version they will test against before fieldwork begins.
Writing the policy in-house or with an implementation partner
This table compares adapting CIS's free IG1 malware defense template in-house, bringing in an implementation partner to prepare systems and evidence, and engaging an independent assessor for formal validation. Read each row against your internal staff capacity and the number of endpoint platforms you run, since those two factors usually decide the split. The main takeaway is that the policy text, the controls and the assessment are owned by different parties, and no single option covers all three.
| Option | Best fit when | What it covers | Main limit |
|---|---|---|---|
| In-house adaptation | Small IT team, one endpoint platform, few asset classes | Editing the free IG1 template to name your anti-malware product, update cadence and removable media rules | Someone must still prove the controls run and keep evidence current |
| In-house adaptation | Security staff already run endpoint tooling and reporting | Mapping Safeguards 10.1 to 10.3 to owners, tools and review dates | Behavior-based and central management items at IG2 need separate planning |
| Implementation partner | Several endpoint platforms, mixed Windows, macOS and Linux estates | Configuring anti-malware consoles, signature update settings, autorun policy and evidence exports | Partner prepares systems and evidence but does not issue any assessment result |
| Implementation partner | Staff capacity is limited during rollout | Documenting the policy against the assessment specification measures for Control 10 | Scope, deliverables and timing must be agreed in writing before work starts |
| Independent assessor | Formal validation or a customer or regulator asks for a third-party view | Testing the implemented controls and reviewing the evidence the enterprise presents | Assessors do not write the policy or configure the tools for you |
| Organization (owner) | Always | Approving the policy, owning the controls, running reviews and accepting residual risk | Cannot be delegated to a partner or an assessor |
| Recurring effort | Ongoing operations after rollout | Signature update checks, console reporting, exception handling and annual policy review | Often underestimated when the rollout ends and no owner is named |
| Quote inputs to request | Before choosing an option | Number of endpoint platforms, asset count by platform, IG level in scope, existing evidence sources | Ask for a fixed scope in writing with deliverables listed |
Why malware defense policies fail assessment
Most malware defense policies fail for the same reason: they describe an intent that the endpoint inventory, update settings and removable media configuration never reflect. The cards below cover the five gaps assessors most often find under Control 10, each with a check you can run before the assessment window.
Policy not matched to real endpoints
A policy that says anti-malware runs on every enterprise asset is only as good as the asset list behind it. Safeguard 10.1 asks for anti-malware software on all enterprise assets and for it to stay maintained, so an assessor will compare the policy against your asset inventory and agent console. Fix: reconcile the endpoint agent count against the Control 1 inventory each quarter, and record the exceptions with an owner and an expiry date.
Unmanaged devices outside scope
Servers in a lab VLAN, contractor laptops, kiosks and virtual machines created outside the standard build often sit outside the anti-malware console. These are the assets that generate the findings, because the policy never names them. Fix: define the scope in the policy by asset class, not by a list of hostnames, and treat any asset without an agent as an unmanaged device that must be onboarded, isolated or formally excepted.
Signature updates not verified
Safeguard 10.2 asks you to configure automatic updates of anti-malware signature files on all enterprise assets. Configuration is not the same as currency. A policy that relies on the update setting alone will miss agents that are stuck, offline or pinned to an old version. Fix: require a report of signature age per asset, and define in the policy what age triggers escalation and who receives the alert.
Autorun set on some platforms only
Safeguard 10.3 asks you to disable autorun and autoplay for removable media. Teams often apply the setting through one Windows group policy and assume the rest of the fleet inherits it. macOS, Linux desktops and legacy images may behave differently. Fix: write the setting per platform in the policy, and record how each platform was checked, such as a configuration scan or a sampled test with a removable drive.
IG2 items assumed covered by IG1
The CIS policy template for Control 10 supports IG1 Safeguards only. Central management (10.6) and behavior-based anti-malware (10.7) are IG2 additions, and the four IG2 Safeguards in Control 10 are not satisfied by an IG1 policy alone. Fix: check whether your organization is in IG2 scope, then add a section covering central management reporting and behavior-based detection with named owners, or document why these do not apply.
Malware defense policy questions buyers ask
Is the CIS malware defense policy template free to use?
Yes, for internal use. CIS publishes its policy templates under the same Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 licence that covers the CIS Controls. Your organization can download the template, adapt its wording to your environment and use it to improve its own security. The licence is non-commercial and prohibits derivatives, so commercial use, such as packaging the template into a paid product or service offering, requires CIS's prior approval. Check the licence terms on the CIS Controls Policy Templates page before you reuse the text in client-facing material. Adapting the policy to your own tools and roles is still expected, so the licence should be read alongside what your internal team plans to do with the document.
Does adopting the CIS template alone satisfy CIS Control 10?
No. A policy states what the organization intends to do, but CIS Control 10 is tested on whether the safeguards are actually running. The policy template supports Safeguards 10.1 and 10.2 by defining the expectation for anti-malware on enterprise assets and automatic signature updates, but an assessor will look for the deployed tooling, configuration settings, coverage reports and update logs that show those expectations are met. Safeguard 10.3, which disables autorun and autoplay for removable media, needs a configuration change that the policy can describe but not enforce. Treat the template as the written standard that your technical controls must match, and keep evidence that each statement in the policy is in operation.
How much internal effort does adopting the malware defense policy take?
The effort depends on how much of Control 10 is already in place and how many asset types you run. Internal work usually falls into four areas: confirming which enterprise assets exist and which operating systems they run, documenting the anti-malware product, update method and management approach, adapting the template's roles and review cycle to your organization, and collecting evidence that each safeguard operates. Drivers that raise effort include mixed endpoint estates, unmanaged devices, multiple anti-malware products, and removable media allowed for business use. Ask any implementation partner for a written scope that lists these areas and the owners who must contribute. No duration is stated here because it depends on your environment.
Does an IG1 policy template cover IG2 malware defense requirements?
No. CIS states that its policy templates are developed to align with CIS Controls v8 and v8.1 and cater exclusively to IG1 Safeguards. Control 10 has seven Safeguards in v8.1: three at IG1 (10.1 to 10.3) and four added at IG2 (10.4 to 10.7). The IG2 additions cover anti-exploitation features, central management of anti-malware, and behavior-based anti-malware. Your policy must extend beyond the template to address these, either by adding sections or by writing a separate standard. Confirm the exact Safeguard wording and Implementation Group assignments in the CIS Controls v8.1 documentation before you finalize your policy.
What evidence does an assessor expect for the malware defense policy?
An assessor looks for proof that the policy is applied, not only that it exists. For Control 10, prepare the approved policy with version history and owner, an asset list showing which enterprise assets have anti-malware installed and running, configuration exports showing automatic signature updates are enabled, and recent update logs. For Safeguard 10.3, provide policy or group settings that disable autorun and autoplay for removable media, along with a sample from each managed device class. For the IG2 safeguards, add central management console reports and records of behavior-based detection configuration. Your independent assessor decides what is sufficient. Check the Control 10 measures in the CIS Controls Assessment Specification before you collect evidence.
Who owns the malware defense policy and its evidence?
The organization owns the policy, its controls and its evidence. Named roles in the policy, such as the security owner and the endpoint administrator, should be accountable for approving changes and reviewing coverage. An implementation partner such as DeployOpen can help plan, configure and document self-hosted tooling inside your infrastructure, and prepare the evidence package. That partner does not issue assessment results, attestations or certifications. Only an independent auditor, assessor or certification body can do that. Agree the division of responsibilities in writing before work starts.
Can open-source tools produce the evidence for Control 10?
Open-source platforms can produce many of the artifacts an assessor asks for, but you must confirm each capability against your environment. Typical candidates include endpoint or host-based detection tools, configuration management that enforces settings such as autorun restrictions, and central logging that stores update and detection records. Evaluate whether a candidate tool can report coverage across every enterprise asset, export configuration state, and retain logs for the period your assessor reviews. DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so a scoped engagement can cover tool selection, deployment and evidence collection.
When to bring in outside help for Control 10
The organization owns the malware defense policy and approves it. Outside help can draft the policy text, but the enterprise's own leadership must adopt it, assign who maintains the anti-malware tooling and accept the residual risk. Safeguard 10.1 asks the enterprise to install anti-malware software on all enterprise assets and keep it maintained, so the accountable owner has to be named inside the organization. A partner can then prepare the endpoint configuration that makes the policy true: deploying the agent, setting signature updates to run automatically as Safeguard 10.2 describes, disabling autorun and autoplay for removable media as Safeguard 10.3 describes, and collecting the console exports, configuration files and exception records that show it. Those artifacts are evidence the organization keeps and can hand to an assessor.
A partner prepares the evidence. Only an independent party reports on it. An implementation partner does not issue an audit report, attestation or certificate for Control 10, and a CIS-aligned policy is not a certification. If a customer, insurer or regulator asks for independent confirmation, the report must come from an assessor or certification body that the requesting party accepts. Where a provider describes CIS Controls services, the reader should ask whether the firm holds CIS Controls Accreditation, which CIS runs with CREST for CIS SecureSuite member organizations that provide implementation, auditing or assessment services. Accreditation status is not a substitute for the assessor's own engagement terms, so confirm the current status directly with CIS before signing and check the named individuals' qualifications and conflicts of interest.
Verify credentials and scope in writing before work starts. Before signing, ask the provider to state in the statement of work which Safeguards it will configure, which evidence it will hand over, who approves the policy text, and whether it will carry out any assessment at all. Ask for proof of current CIS Controls Accreditation if the provider uses that claim, and confirm it on the CIS site rather than relying on a logo. Request the signed scope and deliverables list for any Control 10 engagement, and confirm that your independent assessor is not the same firm that configured the endpoints. Keeping these roles separate protects the credibility of the evidence and avoids a conflict that an assessor would flag.
How DeployOpen prepares Control 10 evidence
DeployOpen works on the CIS malware defense policy template as an implementation partner: we help your team turn Control 10 into deployed anti-malware, documented settings and evidence that your own assessor can review. Your organization owns the policy, the controls and every approval, and only an independent auditor or assessor issues any report.
How we scope
- Agree in writing which enterprise assets, operating systems and removable media channels the Control 10 scope covers
- Confirm whether the policy stops at IG1 Safeguards 10.1 to 10.3 or extends to IG2 Safeguards 10.4 to 10.7
- List the anti-malware products, management consoles and owners that the written scope names
How we build
- Configure anti-malware deployment, automatic signature updates and autorun settings on in-scope systems in your environment
- Set up central management and behavior-based detection where the agreed scope includes IG2 Safeguards
- Test each setting against the Safeguard 10 measures in the CIS assessment specification and record the results
How we hand over
- Deliver the written malware defense process, configuration baselines and a Safeguard-by-Safeguard evidence map
- Export the reports, configuration exports and logs that show coverage, update status and autorun settings
- Document open gaps, owners and remediation steps so your team can run the control after handover
How we support
- Offer ongoing support and periodic reviews as a retainer after the fixed-scope engagement closes
- Refresh signature update checks, coverage reports and configuration baselines when systems or products change
- Confirm with your independent assessor which evidence formats and review periods they require before work starts
