This objective ensures your organization has formally documented the malware protection mechanisms deployed across systems that store, process, or transmit Controlled Unclassified Information (CUI). Your documentation must clearly describe what protections exist, where they are deployed, and how they work.