A.8.7 Technological
Protection against malware
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- SI-3mostlyaligns with — Both controls establish layered malware protection combining automated detection tools, configuration management, user awareness, and incident recovery procedures.
- AT-2partialaligns with — User awareness and training on recognizing and responding to malware directly fulfills the literacy training requirement.
- CM-7partialaligns with — Application allowlisting and restrictions on unauthorized software implement the least-functionality principle to limit malware attack surface.
- CP-10partialaligns with — Business continuity planning and data backup/recovery measures for malware incidents align with system recovery and reconstitution requirements.
- SC-7partialaligns with — Placement of malware detection at network gateways and boundary points implements boundary protection to prevent malware ingress.
- SI-2partialaligns with — The ISO control reduces exploitable vulnerabilities through technical vulnerability management, which directly supports the NIST flaw remediation objective.
Aligned NIST CSF 2.0 outcomes (12)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.PS-05fullcovers — The ISO control's emphasis on application allowlisting, blocklisting, and preventing unauthorized software execution directly fulfills the CSF outcome of stopping installation and execution of unauthorized software.
- DE.CM-09mostlyaligns with — Continuous scanning of systems, email, web traffic, and storage media for malware implements the CSF outcome of monitoring computing hardware, software, and data to detect potentially adverse events.
- PR.AT-01mostlyaligns with — Requiring user awareness and training on recognizing and mitigating malware-infected content satisfies the CSF outcome of equipping personnel with the knowledge to perform tasks securely.
- PR.PS-01mostlyaligns with — Mandating regular updates, configuration of malware tools, and controlled exception processes for disabling protections aligns with establishing and applying configuration management practices.
- ID.RA-01partialaligns with — Reducing exploitable vulnerabilities through technical vulnerability management contributes to identifying and recording vulnerabilities in assets.
- PR.IR-01partialaligns with — Placing malware controls at network gateways and endpoints to block malicious traffic supports protecting networks and environments from unauthorized logical access.
Related OWASP ASVS 5.0 requirements (12)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.4mostlyaligns with — The ISO control's requirement to maintain allowlists and blocklists for external resources and software directly implements the ASVS mandate that applications communicate only with explicitly permitted external systems.
- V13.2.5mostlyaligns with — ISO guidance to configure servers with allowlists of permitted destinations mirrors the ASVS requirement that web or application servers only send requests or load resources from an approved list.
- V13.4.2partialaligns with — The ISO control's call to reduce exploitable vulnerabilities through technical vulnerability management aligns with the ASVS requirement to disable debug modes in production to limit attack surface.
- V15.2.3partialaligns with — ISO's requirement to isolate environments where catastrophic malware consequences could occur aligns with the ASVS rule that production environments must contain only the functionality required for operation.
- V5.2.2partialaligns with — The ISO directive to scan files and attachments for malware before use aligns with the ASVS requirement to validate file extensions and types upon upload to block malicious content.
- V5.2.3partialaligns with — ISO's emphasis on scanning compressed files and archives for malware before processing corresponds to the ASVS check that compressed uploads are inspected for size and content anomalies.
Related weaknesses / CWE (15)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-507mostlyfinds — Malware protection directly detects and blocks Trojan Horse code before execution.
- CWE-508mostlyprevents — Malware-protection controls directly block or detect non-replicating malicious code on endpoints.
- CWE-509mostlyprevents — Directly addresses protection against malware including viruses and worms.
- CWE-434partialmitigates — Application allow-listing and pre-use scanning of received files directly blocks the introduction of executable content that has not been vetted, eliminating the primary vector for unrestricted dangerous file uploads.
- CWE-69partialfinds — Malware-protection mechanisms may scan or block known ADS-based threats, yet coverage is limited to signature or behavior heuristics rather than all ADS handling flaws.
- CWE-20nonenone — Regular automated validation of system software and data content, combined with scanning of all inbound files, enforces input validation at the boundary before untrusted content is processed.
- CWE-400nonenone — Business-continuity and recovery procedures, including offline backups, reduce the impact of malware-induced resource exhaustion or denial-of-service conditions.
- CWE-502nonenone — Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.
- CWE-64nonenone — Malware protection may detect some .LNK-based attacks but does not mitigate the underlying shortcut-following weakness.
- CWE-79nonenone — Webpage malware scanning and block-listing of known malicious sites reduce the likelihood that reflected or stored script payloads reach a user’s browser.
- CWE-94nonenone — Controls that restrict unauthorized or malicious code from being introduced via external networks or removable media limit opportunities for an attacker to inject and execute arbitrary code.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1027partialdetects — Regular automated validation of system files and data content helps surface obfuscated or packed malware that would otherwise remain hidden on disk.
- T1055partialmitigates — Endpoint malware detection combined with change-management controls makes it harder for injected code to persist or remain undetected after initial execution.
- T1059partialdetects — Preventing or detecting unauthorized scripts and interpreters through allow-listing and regular integrity validation limits adversaries’ ability to abuse command and scripting interpreters.
- T1105partialmitigates — Network-level and endpoint malware scanning of incoming files and software reduces the likelihood that tools transferred over C2 channels will execute successfully.
- T1204partialprevents — Application allow-listing and pre-use malware scanning of attachments, downloads, and web content directly block or detect the user-execution vectors that adversaries rely on to launch malicious payloads.
- T1218partialmitigates — Application allow-listing and malware scanning reduce the success of proxy-execution techniques that rely on trusted system binaries to run attacker code.
- T1566partialmitigates — Email and web gateway scanning plus block-listing of known malicious sites intercept spear-phishing attachments and links before they reach the user.
- T1190nonemitigates — Vulnerability management and malware-protection controls shrink the attack surface that adversaries exploit when targeting public-facing applications.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.