Per NIST SP 800-53, “Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways, including by electronic mail, the world-wide web, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities.”

Specifically, Per SI-3 of NIST SP 800-53, organizations are to “Implement…Automatically update…Configure malicious code protection mechanisms.”