SI.1.004 — Update Malicious Code Protection Mechanisms

What SI.1.004 means in plain English

Your antivirus is only as good as its latest update. New viruses and malware are discovered every day, and your antivirus needs the latest definitions to catch them. Make sure virus definitions update automatically at least once per day. Also update the antivirus engine itself when new versions are released. If a computer has been offline for a while (like a laptop that was in a drawer for a month), update it before reconnecting it to the network.

The assessment question

“Are antivirus and anti-malware definitions configured to update automatically at least daily, and are antivirus engine updates applied when new versions are released?”

How to implement SI.1.004

1. Verify Windows Defender automatic updates are enabled: Windows Security > Virus & Threat Protection > Protection updates > check that "Security intelligence" shows a recent update date (within 24 hours).
2. Ensure Windows Update is set to install updates automatically, as Defender definition updates are delivered through Windows Update.
3. For any offline or infrequently used devices, establish a procedure: before reconnecting to the network, connect to the internet, run Windows Update, and verify Defender definitions are current.
4. If using a third-party antivirus, verify its automatic update settings are enabled and check the vendor's update frequency (should be at least daily).

Evidence your assessor will ask for

• Windows Defender definition update timestamps showing daily updates across all systems
• Windows Update configuration showing automatic updates are enabled
• Antivirus engine version information showing the current version is installed
• Procedure for updating offline devices before network reconnection

More System and Information Integrity controls