Malware protection: what Cyber Essentials needs

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The two accepted approaches in Requirements v3.3

Section E.5 of the NCSC Requirements for IT Infrastructure v3.3 (pages 23–24) requires an active malware protection mechanism on every in-scope server, desktop, laptop, tablet and mobile phone. Earlier editions of Cyber Essentials allowed a third option (“application sandboxing”), which was removed; under v3.3 you must use at least one of these two methods on each device:

Option 1: Anti-malware software (for Windows and macOS servers, desktops and laptops)

Where you use anti-malware software, v3.3 specifies that it must be active and configured to:

• Be updated in line with vendor recommendations (automatic daily or real-time signature and engine updates).
• Prevent malware from running and prevent the execution of malicious code (real-time on-access scanning).
• Prevent connections to malicious websites over the internet (web protection / SmartScreen / DNS filtering).

Option 2: Application allow-listing (for all in-scope devices, including phones and tablets)

Where you use application allow-listing (how iPhones, iPads and managed Android devices are normally covered, or Windows/macOS machines running strict application control), you must:

• Restrict execution to approved, code-signed applications only.
• Actively approve applications before deploying them to devices, and maintain a current list of approved applications.
• Ensure users cannot install any application that is unsigned or has an invalid signature (for example, restricting mobile devices to the official Apple App Store or Google Play Store / managed company portal, with sideloading blocked).

Is built-in Microsoft Defender Antivirus enough?

Yes, on Windows 10 and Windows 11 — provided both real-time protection and Microsoft Defender SmartScreen (or Network Protection) are switched on so that it blocks connections to malicious websites as well as scanning files. You do not need to buy a third-party consumer antivirus product for Windows if Microsoft Defender is active, updating automatically, and not disabled by remnants of an old antivirus tool.

What about Macs? macOS includes Apple’s built-in XProtect, which runs silently in the background, but in a Cyber Essentials Plus audit assessors test whether your Mac actively blocks known test malware files (such as EICAR payloads) delivered by email and web download and prevents connections to malicious URLs. Relying on bare macOS defaults without a managed endpoint agent (such as Microsoft Defender for Business / Endpoint on macOS, which is included in Microsoft 365 Business Premium) is a common reason Mac fleets fail Cyber Essentials Plus.

How to cover iPhones, iPads and Android phones

Smartphones and tablets in scope (including personal BYOD phones that access work email or files) meet Control 5 through application allow-listing when they are not jailbroken or rooted, block sideloading of unsigned apps, and only install software from an approved list or controlled official store. Under v3.3, you should maintain a list of the business apps approved for use on work mobile devices.