Short answer: Level 1 requires four things.
- Malware protection where it matters: every computer, company email and any server you run.
- Protection that keeps itself up to date.
- A scan schedule that actually runs.
- Real-time scanning of files that come from outside the company.
For many small businesses, the protection built into Windows and into Microsoft 365 or Google Workspace can cover all four, once it is switched on and checked.
What the rule asks
Three practices, six checks:
| Practice | The assessor checks that… |
|---|---|
| SI.L1-b.1.xiii | you have named the places that need protection, and protection is in place there |
| SI.L1-b.1.xiv | protection updates when new releases come out |
| SI.L1-b.1.xv | you have set how often scans run, scans run on that schedule, and files from outside (downloads, email attachments, USB drives) are scanned as they are downloaded, opened or run |
How to do it in Microsoft 365
The steps below use Microsoft 365 Business Premium, which includes Microsoft Defender for Business and Intune. On Business Basic or Standard, make the same checks on each PC in Windows Security; every Microsoft 365 plan scans email for malware.
- Name the places. In the Microsoft Defender portal (security.microsoft.com), go to Assets → Devices and list the computers that need protection. Count email, and any server you run, as places too.
- Turn protection on. On every PC, check Windows Security → Virus & threat protection and make sure real-time protection is on. In the Defender portal, apply the Standard preset security policy so email is scanned for malware.
- Keep it current. Spot-check that each PC shows recent protection updates, under Windows Security → Virus & threat protection → Protection updates. Machines that have stopped updating show up in the Defender portal's device list.
- Set a scan schedule. In the Microsoft Intune admin center, go to Endpoint security → Antivirus, create a Microsoft Defender Antivirus policy and set a scheduled scan, for example weekly. Without Intune, set the schedule on each PC with Group Policy (Microsoft Defender Antivirus → Scan) or the Set-MpPreference command in PowerShell.
- Scan what comes in. Keep real-time protection on (Manage settings → Real-time protection) and leave SmartScreen on under App & browser control. Email attachments are scanned by the email service.
What proof to keep
- The list of protected places (each computer, your email and any server you run) and what protects each one.
- A screenshot from each computer showing protection on.
- Your stated rule for updates, and the date each computer last updated.
- Your stated scan schedule, and the date of each computer's last scan.
- A statement that real-time protection stays on, and who scans email attachments.
Common mistakes
- Forgetting that email counts as a place that needs protection.
- A scan schedule written down but never checked against real scan dates.
- One old laptop running an expired third-party antivirus.
- Real-time protection turned off "for a minute" and never turned back on.
Do it step by step
The Malware protection task in ReComply lists each device, records what protects it and when it was last scanned and updated, and keeps the screenshots together for your annual affirmation.
Start free