Erwägungsgrund 17

In order to protect the networks of the relevant entities and their information systems against malicious and unauthorised software, those entities should use malware detection and repair software. Where the relevant entities, based on the risk assessment, consider that the use of malware detection and repair software is not adequate or where the malware detection and repair software is not available at all times, those entities should consider additional measures and controls that prevent or detect the use of unauthorised software, and the use of known or suspected malicious websites. The relevant entities should also consider implementing measures to minimize the attack surface, reduce vulnerabilities that can be exploited by malware, control the execution of applications on user workstations or user end devices, and employ email and web application filters to reduce exposure to malicious content.