{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","download":{"releaseId":"sha256:ad7e891a861e6e7e426e0fa5e6d98feb4cd23a0cb52feedbe35a918dceea5205","slug":"controls-malware-email-web-content-defense-operations","url":"/assets/agent_workflow-controls-malware-email-web-content-defense-operations-78d327b4.e475728c336b65aa.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-malware-email-web-content-defense-operations","description":"Standing operator workflow for anti-malware coverage, detection handling, spam and phishing filtering, and mobile-code and website-content control, run on a monthly cadence by the security operations malware defense lead. Each monthly run is a new workflow instance attached to the existing Process item \"Malware, Email & Web Content Defense Operations\" (process_type: security_process, frequency: monthly), with Item relationships to the Control items it operates — UC-VULN-05 (malicious code protection) and UC-NET-13 (mobile code) in the control library (framework: nist-800-53, iso-27001, pci-dss). In scope: every system component commonly affected by malicious software, the email and web filtering entry and exit points, the mobile-code technologies in use, and website category and reputation filtering. Out of scope: endpoint patching and vulnerability remediation, incident response beyond first-line quarantine and alerting, and network firewall rule management. No upstream workflow feeds it: the monthly scope, the in-scope component and channel list, the accountable owners, and the prior-cycle carryover — the previous instance's open Issue items and step documents — are its own initial inputs. It produces the coverage reconciliation report, the detection-and-response log, the mobile-code authorization list, the tuned email/web and website-content filtering packages, a capability-health dashboard, a signed readiness classification, and a corrective-action register. It is terminal by design: rather than hand off to a downstream workflow, the close-and-archive step preserves the signed operating record under retention and loops carry-forward Issue items into the next monthly cycle.","details":{"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-malware-email-web-content-defense-operations","capabilities":[],"controls":["UC-VULN-05","UC-NET-13"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:ad7e891a861e6e7e426e0fa5e6d98feb4cd23a0cb52feedbe35a918dceea5205","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-malware-email-web-content-defense-operations","standards":["nist-800-53","iso-27001","pci-dss"],"teams":["it"]},"download":{"releaseId":"sha256:ad7e891a861e6e7e426e0fa5e6d98feb4cd23a0cb52feedbe35a918dceea5205"},"history":{"digest":"3ff91b6497375b44e1618f0741bbd1a2b437fbc8dc8ac071bd4a8614985dcb51","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-10-04T21:48:26Z","updatedRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4"},"id":"wf:C44","mapUrl":"https://evidenceflows.com/?v=1&node=wf%3AC44","slug":"controls-malware-email-web-content-defense-operations","sourceIds":["iso-27001","nist-800-53","pci-dss"],"sourceUrl":null,"title":"Malware, Email & Web Content Defense Operations","type":"workflow"},"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:16145adcf912d6562f3fdbd6c8cac63b3df1e8b6cd132754c583b608f8930bc7","properties":{},"sourceDetailPath":"/data/v1/records/wf-c44-c8ff29dd.json","sourceId":"wf:C44","targetDetailPath":"/data/v1/records/uc-uc-vuln-05-5870fcee.json","targetId":"uc:UC-VULN-05","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:92574c9f6490a9c26946ae9223b5e2a3b0596de54a898d472215cff4ccc42699","properties":{},"sourceDetailPath":"/data/v1/records/wf-c44-c8ff29dd.json","sourceId":"wf:C44","targetDetailPath":"/data/v1/records/uc-uc-net-13-df790edf.json","targetId":"uc:UC-NET-13","type":"operates"}],"schemaVersion":1}