Anti-Malware

Applies to. 5.2.1 requires an anti-malware solution on all system components, except those a periodic evaluation under 5.2.3 concludes are not at risk from malware. 5.3.1 to 5.3.5 then govern the solution itself: kept current by automatic updates, running periodic and active or real-time scans or continuous behavioural analysis, scanning removable media when it is inserted or connected, keeping its own audit logs under 10.5.1, and not able to be disabled or altered by users without a documented, management-approved exception for a limited time. 10.7.2 adds that a failure of the anti-malware solution is a critical security control failure to be detected, alerted and addressed promptly, so the obligation runs past installing the software.

Example. A restaurant chain runs anti-malware on the back-office servers that hold its card transaction records and on the staff workstations that connect to them. When the agent on one server silently stops updating, the central console flags it the same morning and the team restores the service, which is the kind of failure 10.7.2 expects an entity to catch.

Limits. Anti-malware detects and contains malicious software; it does not close the weakness the malware came through, so patching remains a separate duty. It is not a change-detection mechanism either: an unexpected new file on a payment server is something file integrity monitoring under 11.5.2 reports whether or not the anti-malware engine recognises the file as malicious. The term is also wider than antivirus: a virus is one class of malicious software, and anti-malware is expected to handle the others, such as ransomware and spyware, as well.