NIST 800-171 Controls · System and Information Integrity
SI.1.005 — Perform Periodic and Real-Time Malware Scans
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
What SI.1.005 means in plain English
Real-time scanning means your antivirus checks every file the moment it is opened, downloaded, or run. Periodic scanning means running a full scan of the entire hard drive on a schedule — at least weekly. You need both. Real-time scanning catches threats immediately, but a full scan can find malware that was hiding before your definitions were updated. Also, any file from email, a USB drive, or the internet should be scanned before opening it.
The assessment question
“Is real-time malware scanning enabled on all systems to scan files as they are downloaded or opened, and do you run periodic full-system scans at least weekly?”
How to implement SI.1.005
- Verify real-time protection is enabled in Windows Defender: Windows Security > Virus & Threat Protection > verify "Real-time protection" toggle is ON.
- Schedule a weekly full system scan: open Task Scheduler > create a new task that runs "C:\Program Files\Windows Defender\MpCmdRun.exe -Scan -ScanType 2" every Sunday at 2:00 AM.
- Enable scanning of removable drives: Windows Security > Virus & Threat Protection > Scan options > ensure "Removable drives" is included in scan settings.
- Configure email attachment scanning: in Microsoft 365 GCC, verify Safe Attachments policy is enabled in Microsoft Defender for Office 365.
- Educate employees: never open a file from a USB drive or email attachment without first verifying the source. When in doubt, right-click the file and select "Scan with Microsoft Defender."
Evidence your assessor will ask for
- Windows Defender settings showing real-time protection is enabled on all systems
- Scheduled task or scan policy showing weekly full scans are configured
- Recent full scan reports showing completion and findings (or clean results)
- Email scanning configuration showing attachments are scanned before delivery
- Policy or procedure requiring scanning of removable media before use
Does AI prompt monitoring help with this control? Honestly, no.
SI.1.005 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More System and Information Integrity controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.