Malware

Applies to. Requirement 5 is written against malware. An anti-malware solution must be deployed on all system components except those a periodic evaluation finds not at risk (5.2.1, 5.2.3), it must detect all known types of malware and remove, block or contain them (5.2.2), stay current through automatic updates (5.3.1), run periodic and real-time scans or continuous behavioural analysis (5.3.2), scan removable media when it is connected (5.3.3), keep audit logs (5.3.4) and be protected from being disabled or altered by users (5.3.5). Failure of the anti-malware solution is also one of the critical security control failures that must be detected and alerted on under 10.7.2, and under 10.7.1 for service providers.

Limits. The standard does not require anti-malware on every component: 5.2.1 allows exceptions for components a periodic evaluation under 5.2.3 concludes are not at risk, with the evaluation frequency set by the entity's targeted risk analysis (5.2.3.1). The exception list and the components without anti-malware must match (5.2.3.c).