* Do we run anti-virus software? Which tool(s) do we use? o On all servers? On all critical desktops? o On all end user desktops?

* • Are our virus definitions current?

o How often are the definitions updated? (At least twice weekly is advised; many experts suggest daily updates.)

* • Do we run spyware detection software on our servers and on end user computers?

* • How are servers and end-user computers given new antivirus definitions? (From the vendor’s Web site, from a local server, or otherwise?)

* • Have we enabled automatic scanning for virus definition updates on servers and end-user computers?

* Do we scan incoming and outgoing email for viruses (as well as other modes of transmission)?

* Do we educate our users about virus avoidance (e.g. be wary of attachments in general, don’t run .EXE files sent via email, etc.)

* computers to install new software, so as to limit the capacity of viruses to install themselves? o E.g. using Microsoft’s Group Policy Option?