Control08.md

Critical Control 8 - Malware Defenses

Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.

PR.PT-1 Audit/log records are determined, documented, implemented, and reviewed in accordance with policy

PR.PT-2 Removable media is protected and its use restricted according to policy

PR.PT-3 The principle of least functionality is incorporated by configuring systems to provide only essential capabilities

PR.PT-4 Communications and control networks are protected

PR.PT-5 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations

DE.CM-1 The network is monitored to detect potential cybersecurity events

DE.CM-2 The physical environment is monitored to detect potential cybersecurity events

DE.CM-3 Personnel activity is monitored to detect potential cybersecurity events

DE.CM-4 Malicious code is detected

DE.CM-5 Unauthorized mobile code is detected

DE.CM-6 External service provider activity is monitored to detect potential cybersecurity events

DE.CM-7 Monitoring for unauthorized personnel, connections, devices, and software is performed

DE.CM-8 Vulnerability scans are performed