Are automatic updates and periodic scans enabled Examine configurations, and being performed? including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, Examine anti-virus configurations and are logs retained in accordance with PCI DSS Review log retention processes Requirement 10.7? 5.3 Are all anti-virus mechanisms: Examine anti-virus configurations Actively running? Examine system components Unable to be disabled or altered by Observe processes Note: solutions may be temporarily disabled Interview personnel only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. 5.4 Are security policies and operational procedures for Review security policies and protecting systems against malware: operational procedures Documented Interview personnel In use Known to all affected parties? Requirement 6: Develop and maintain secure systems and applications Response (Check one response for each question) PCI DSS Question Expected Testing Yes with Yes CCW No N/A
Are automatic updates and periodic scans enabled and being performed? Examine configurations, including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, and are logs retained in accordance with PCI DSS Requirement 10.7? Examine anti-virus configurations Review log retention processes 5.3 Are all anti-virus mechanisms: Actively running? Unable to be disabled or altered by Note: solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel 5.4 Are security policies and operational procedures for protecting systems against malware: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel Requirement 6: Develop and maintain secure systems and applications PCI DSS Question Expected Testing Response (Check one response for each question) Yes Yes with CCW No N/A