5.1 Is anti-virus software deployed on all systems commonly Examine system configurations affected by malicious software? 5.1.1 Are anti-virus programs capable of detecting, removing, Review vendor documentation and protecting against all known types of malicious Examine system configurations software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? 5.1.2 Are periodic evaluations performed to identify and Interview personnel evaluate evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? 5.2 Are all anti-virus mechanisms maintained as follows: Are all anti-virus software and definitions kept Examine policies and procedures current? Examine anti-virus configurations, including the master installation Examine system components Are automatic updates and periodic enabled and Examine configurations, being performed? including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, Examine anti-virus configurations and are logs retained in accordance with PCI DSS Review log retention processes Requirement 10.7? 5.3 Are all mechanisms: Examine anti-virus configurations Actively running? Examine system components Unable to be disabled or altered by users? Observe processes Note: Anti-virus solutions may be temporarily disabled Interview personnel only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active.
5.1 Is anti-virus software deployed on all systems commonly affected by malicious software? Examine system configurations 5.1.1 Are anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits)? Review vendor documentation Examine system configurations 5.1.2 Are periodic evaluations performed to identify and evaluate evolving malware threats in order to confirm whether those systems considered to not be commonly affected by malicious software continue as such? Interview personnel 5.2 Are all anti-virus mechanisms maintained as follows: Are all anti-virus software and definitions kept current? Examine policies and procedures Examine anti-virus configurations, including the master installation Examine system components Are automatic updates and periodic enabled and being performed? Examine configurations, including the master installation Examine system components Are all anti-virus mechanisms generating audit logs, and are logs retained in accordance with PCI DSS Requirement 10.7? Examine anti-virus configurations Review log retention processes 5.3 Are all mechanisms: Actively running? Unable to be disabled or altered by users? Note: Anti-virus solutions may be temporarily disabled only if there is legitimate technical need, as authorized by management on a case-by-case basis. If anti-virus protection needs to be disabled for a specific purpose, it must be formally authorized. Additional security measures may also need to be implemented for the period of time during which anti-virus protection is not active. Examine anti-virus configurations Examine system components Observe processes Interview personnel
PCI-DSS-v3_2-SAQ-C_VT-rev1_1.docx