This objective requires your organization to identify the tools, services, and strategies used to protect systems against malware, especially for systems that store, process, or transmit Controlled Unclassified Information (CUI).