What is the Antivirus control?
Strike Graph's default control language is: "Antivirus is installed on all workstations and servers to help protect against viruses and malicious software on the systems."
This language should be customized to reflect the specific process that your organization has defined. For example, if your organization only installs antivirus on workstations or servers (and not both), update the control language to align with your internal practice. It's important that your stated control description accurately reflects how your organization implements this control.
How do I perform this control?
Any implementation of antivirus software should follow a risk-based approach. Generally speaking, auditors like to see antivirus enabled for any Windows laptops, but they are less stringent for Mac and Linux machines due to the much smaller amount of malware that targets these operating systems. Due to the lower risk, you can avoid rolling out an antivirus solution to your Mac and Linux machines if you don't feel it necessary.
Device management software that manages antivirus on employee laptops is not a requirement for SOC 2, but it can be helpful to make sure that employee laptops are up to date and have antivirus software configured properly.
Generally, auditors do not request antivirus to be installed on servers running Linux; they only want to see antivirus on Windows servers. So, if you do not have any servers running Windows, you can remove the mention of servers from the control language, and you can deactivate the Antivirus Configuration - Server evidence item.
Below is a quick guide to what auditors are looking for regarding antivirus-related evidence items:
Antivirus Configuration - Workstation (workstations are employee computers/laptops)
Windows computers: All laptops will need antivirus enabled; the native Windows Defender antivirus suffices as long as it is enabled on all employee laptops.
Mac computers: Antivirus is not needed, though we recommend disk encryption through a tool like JamF.
Linux computers: Antivirus is not needed, but ClamAV is a free and easy-to-use antivirus solution.
Antivirus Configuration - Server
Linux servers/instances: Antivirus is not needed, as there are relatively few viruses that target these machines. If you only run Linux servers, consider deactivating this evidence item.
Windows servers/instances: Antivirus is needed; the native Windows Defender antivirus suffices as long as it is enabled.