What an auditor, or Sekit's evidence engine, asks for.
Email security configuration
The email protections against phishing and spoofing: anti-spam filtering and the domain's SPF, DKIM and DMARC records.
Endpoint protection console
The antivirus or advanced protection (EDR) tool installed on devices, and proof that it is deployed and up to date across the fleet.
Security awareness training records
The proof that employees receive regular security training and complete it, including role-specific training.
From the Sekit evidence catalog
In practice
Malware protection on paper usually means an antivirus license was purchased. The gap is whether it is running everywhere: an SME's EDR console typically shows a handful of devices offline or unenrolled, often exactly the ones an employee bought personally and connected to email without IT ever provisioning it. Phishing simulations run once a year around awareness month, but the employees who click are not tracked for repeat training, so the same people fail the next simulation twelve months later. Email authentication records are configured for the main domain but forgotten on a secondary one.
Common gaps
EDR is licensed for the whole fleet, but the console shows several devices offline or never enrolled, often unmanaged personal devices.
Phishing simulations run annually, but employees who click are not tracked for repeat failures or given targeted follow-up training.
Email authentication records, SPF, DKIM, DMARC, are only partially configured, leaving some company domains open to spoofing.
Questions your auditor will ask
How does the company know malware protection is running, not merely licensed?
An EDR-class agent watches endpoint behavior in real time on every device and isolates or blocks threats automatically, with alerts investigated on an agreed timeframe.
What stops a phishing email from reaching an inbox?
SPF, DKIM and DMARC are published for the domain and inbound mail is filtered for malicious links and attachments before delivery.
How does the company measure whether staff can spot phishing?
Simulated phishing campaigns run on a set cadence, measure click and report rates, and automatically assign remediation training to anyone caught.
Are containers and cloud workloads covered by malware protection, or only laptops?
Container images are scanned before deployment and cloud workload protection tooling monitors runtime behavior separately from endpoint EDR.
Where regulation demands it
NIS2 Article 21 requires protection against malicious and unauthorised software (6.9) alongside basic cyber hygiene and awareness training (8.1, 8.2).
ENS mp.s.1 requires protecting electronic mail specifically, the channel most malware and phishing attacks use to reach staff.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.