Small Business Antivirus Policy Template: Build and Maintain an Endpoint Security Standard

Overview

An antivirus policy should explain what is protected, how protection is managed, and what happens when a device or alert requires attention. It is not a substitute for backups, identity security, email security, or staff training. Instead, it provides the endpoint layer that supports those controls.

The policy can apply to company-owned Windows computers, Macs, mobile devices, servers, and personally owned devices used for business, but the scope should be stated clearly. If a device cannot run the approved protection or cannot be monitored by the business, document the exception and define an alternative control.

Choose the protection platform based on your environment rather than on a feature list alone. Consider operating systems, Microsoft 365 integration, remote workers, administrator capacity, reporting, ransomware protection, and the response process. A traditional antivirus product may be appropriate for a small and simple fleet. A platform with endpoint detection and response capabilities may be more suitable when the business needs richer investigation and response workflows. For comparison criteria, see our best antivirus for small business buyer’s guide.

Keep the policy short enough to use. The main document should establish requirements, while technical settings, device inventories, and alert procedures can be maintained in linked checklists or administrator documentation.

Checklist by scenario

For every managed endpoint

• Record the device owner, operating system, business purpose, and management status.
• Install one approved real-time malware protection product. Avoid running multiple products that provide overlapping real-time scanning unless the vendors explicitly support that arrangement.
• Enable protection against malicious files, unwanted applications, and suspicious behavior where those controls are available and appropriate.
• Require automatic security intelligence, engine, and application updates. Define what happens when a device has been offline and misses updates.
• Prevent standard users from disabling protection or changing important settings. Keep administrative access limited to designated IT administrators.
• Configure alerts to reach a monitored mailbox, console, ticket queue, or other named destination.
• Confirm that the product reports device health, last check-in, protection status, and recent detections.

For Windows 11 and other Windows devices

• Confirm that the endpoint protection product supports the Windows versions in use and receives updates on those versions.
• Use centrally managed settings where possible instead of relying on individual employees to choose scan or update options.
• Enable tamper-resistant controls if the platform provides them, and document who can approve changes.
• Pair malware protection with operating system updates, disk encryption where appropriate, least-privilege accounts, and tested backups.

For Microsoft-focused teams, the Microsoft Defender for Business deployment guide and its accompanying setup checklist can help organize deployment decisions.

For remote workers

• Require protection to remain active away from the office network.
• Ensure devices can receive policy and security updates over the internet without depending on an office-only management server.
• Define how employees report pop-ups, suspicious files, lost devices, and suspected compromise.
• Use separate controls for web, email, and identity risks. Antivirus alone does not validate every link or prevent a user from submitting credentials to a convincing fake site.

For exclusions and specialized software

• Require a documented business reason before excluding a file, folder, process, or website from scanning.
• Record the requester, approver, affected devices, date, and review date.
• Use the narrowest possible exclusion and avoid broad exclusions such as an entire drive or user profile.
• Remove temporary exclusions after troubleshooting or software installation is complete.

For detections and suspected incidents

• Define who reviews high-severity alerts and the expected response time during business hours.
• State when a device should be isolated from the network, such as when ransomware activity, credential theft, or repeated malicious behavior is suspected.
• Preserve alert details before clearing them when investigation may be needed.
• Record the device, user, detection, action taken, and final disposition.
• Escalate suspected compromise rather than repeatedly dismissing detections. Use the Windows malware removal incident response checklist when a device may already be infected.

For employee responsibilities

• Do not disable protection, approve unknown prompts, or install unapproved software to bypass a warning.
• Report suspicious messages, downloads, browser warnings, and unexpected login prompts promptly.
• Do not assume that a familiar brand, QR code, or urgent request is safe. Staff can use the guide on checking suspicious links safely before opening them.
• Follow the company process for removable media, personal devices, and software requests.

What to double-check

Before approving the policy, verify that its requirements can actually be measured. “Keep antivirus enabled” is difficult to manage unless the administrator can see protection status and identify devices that have stopped checking in. Add a source of evidence for each important control, such as a management dashboard, device report, ticket, or configuration record.

Check the boundary between antivirus and other security tools. Email security for Microsoft 365, DNS filtering, browser controls, backup protection, and identity security address different risks. If the business uses DNS filtering, document whether it applies to remote devices as well as office connections. The DNS filtering guide for small business provides a separate planning reference.

Review exclusions particularly carefully. An exclusion may resolve a compatibility problem while reducing visibility in an important location. Require an owner and expiry or review date for every exception.

Test the alert path with a safe, approved test procedure. The objective is to confirm that an alert reaches the right person, contains enough information to act, and leads to a documented decision. Do not create a test detection by downloading live malware.

Finally, check the policy against actual work patterns. A business with contractors, shared workstations, point-of-sale systems, developers, or remote employees may need different coverage rules. The small business endpoint security checklist can help identify controls that sit outside the antivirus policy.

Common mistakes

• Protecting only office computers: Laptops used from homes, hotels, and client sites still need management and update coverage.
• Confusing installation with management: A product installed on a device may still be outdated, disabled, or absent from the administrator’s reporting.
• Allowing unlimited exclusions: Permanent, broad exclusions can hide malicious activity and make later investigation harder.
• Ignoring alert ownership: An alert that goes to an unmonitored inbox is not an operational control.
• Relying on scheduled scans alone: Scheduled scans can support protection, but they should not replace active, up-to-date real-time monitoring.
• Using the policy as a substitute for backups: Antivirus may reduce malware risk, but recovery also depends on protected, tested backups and a documented restoration process.
• Forgetting performance and compatibility: Test approved settings with essential business applications. If protection causes a problem, document a narrow fix rather than disabling broad controls.
• Failing to define incident escalation: Employees and administrators need clear instructions for suspected ransomware, credential theft, or a device that continues to show detections.

When to revisit

Review the policy at least before major planning or budgeting cycles and whenever the underlying environment changes. A quarterly review is a practical cadence for many small businesses, but a higher-risk or fast-changing environment may require more frequent checks.

Trigger an earlier review when you change antivirus or endpoint platforms, add a new operating system, acquire another business, introduce remote or hybrid work, deploy new line-of-business software, experience a malware detection, or change the Microsoft 365 and identity environment. Also revisit the document after a serious alert, even if the endpoint was successfully cleaned.

Use this short review sequence:

1. Export or inspect the current device inventory and identify unmanaged or inactive endpoints.
2. Check update status, real-time protection, tamper controls, and recent alert coverage.
3. Review every exclusion and remove those without a current business justification.
4. Confirm that alert recipients, escalation contacts, and incident records are still accurate.
5. Test a backup restoration separately from the antivirus policy.
6. Update employee instructions when workflows, applications, or phishing risks change.
7. Record the reviewer, review date, changes made, and next review date.

Keep a dated copy of each approved version. That simple record shows what the business expected at a particular time and makes gaps easier to investigate after an incident. Revisit the policy before seasonal planning and whenever tools or workflows change; endpoint security is most useful when the written standard matches the devices people actually use.