SOC 2 Preventing and Detecting Malicious Software (CC6.8)

Overview:
The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives.

Action Items:
1) Create an anti-virus policy and related procedures and publish on the company intranet for employees to access and review.
2) Inspect antivirus configurations to determine that a central antivirus server is configured with antivirus software to protect registered production servers and workstations.
3) Inspect the file monitoring software configurations and dashboard to determine that FIM software is in place to monitor, detect, alert the information security team, and track the alert through resolution upon unauthorized software installation or configuration changes to certain production systems.
4) Inspect the user access listings to determine that the ability modify the FIM software is restricted to authorized IT administrative personnel.

Related Documents:
1) Anti-virus configurations
2) Anti-virus policy
3) File integrity monitoring software configurations
4) User access list for personnel who have administrative access to FIM software

Additional Guidance:
The following points of focus highlight important characteristics related to this criterion:

1) Restricts Application and Software Installation—The ability to install applications and software is restricted to authorized individuals.
2) Detects Unauthorized Changes to Software and Configuration Parameters—Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software.
3) Uses a Defined Change Control Process—A management-defined change control process is used for the implementation of software.
4) Uses Antivirus and Anti-Malware Software—Antivirus and anti-malware software is implemented and maintained to provide for the interception or detection and remediation of malware.
5) Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software—Procedures are in place to scan information assets that have been transferred or returned to the entity's custody for malware and other unauthorized software and to remove any items detected prior to its implementation on the network.