For virus scanning, you can have a policy that reads. The organization shall scan every email message that passes through its server to check for computer viruses, worms, or other executable items that could pose a threat to the security of the network.