Most certifications, and in particular, ISO 27001 asks if you have anti-malware running. Now, the thing about ISO and many of the other certifications, if you

Most certifications, and in particular, ISO 27001 asks if you have anti-malware running. Now, the thing about ISO and many of the other certifications, if you can demonstrate some mitigating control, say aggressive network monitoring, or pre-scanning files before they get loaded onto your target system, then you can pass. For example, http://www.iso27001security.com/html/27002.html http://www.iso27001security.com/html/27002.html on 12.2 mentions this, along with a vaguely-stated user awareness. All auditors looking at you for this certification will ask this question.