5.2 Malware is prevented, or detected and addressed
How to meet it
Deploy anti-malware on systems commonly affected, and evaluate periodically for those not.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 5.2, in plain English.
5.2.1An anti-malware solution is deployed on all system components except those shown by periodic evaluation to not be at risk.
5.2.2The anti-malware solution detects all known malware types and removes, blocks, or contains them.
5.2.3Components deemed not at risk are evaluated periodically to confirm protection is still unnecessary.
5.2.3.1The frequency of those periodic evaluations is set in the entity targeted risk analysis.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.Malware protection policyUse for ISO 27001 A.8.7, SOC 2 Security, and PCI DSS requirement 5 anti-malware controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Endpoint and mobile device policyUse for ISO 27001 A.6.7, A.7.9, A.8.1, malware protection, remote work, and SOC 2 endpoint controls.
Open the control-to-policy map← 5.1 Processes and mechanisms are defined and understood5.3 Anti-malware mechanisms are active and monitored →
Back to Requirement 5, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.