Under PCI DSS, anti-virus software should be actively running and cannot be disabled or altered by users unless authorized by mgmt for a limited time.

Under PCI DSS, anti-virus software should be actively running and cannot be disabled or altered by users unless authorized by mgmt for a limited time.

• A. Antivirus cannot be disabled or altered by users unless specifically authorized by mgmt on a case-by-case basis for a limited time period
• B. Antivirus is optional
• C. Antivirus logs must be retained
• D. Antivirus must be installed on all devices

Answer: (A)

Anti-virus software must be actively running and protected from tampering. PCI DSS requires that anti-virus be deployed on systems that handle cardholder data and that it remains active and unalterable by regular users, with any exceptions only permitted by management for a limited time. This captures the essential security control: the system should continuously monitor for malware and not allow end users to disable or bypass it, except for a controlled, temporary authorization. The idea that antivirus is optional contradicts PCI DSS. While keeping logs is important for auditing, the core requirement is that the anti-virus remains active and tamper-resistant, not merely that logs exist. And while antivirus should be deployed on systems within scope, stating it must be installed on all devices oversimplifies scope and misses the emphasis on keeping the protection active and unmodified by users.

Anti-virus software must be actively running and protected from tampering. PCI DSS requires that anti-virus be deployed on systems that handle cardholder data and that it remains active and unalterable by regular users, with any exceptions only permitted by management for a limited time. This captures the essential security control: the system should continuously monitor for malware and not allow end users to disable or bypass it, except for a controlled, temporary authorization.

The idea that antivirus is optional contradicts PCI DSS. While keeping logs is important for auditing, the core requirement is that the anti-virus remains active and tamper-resistant, not merely that logs exist. And while antivirus should be deployed on systems within scope, stating it must be installed on all devices oversimplifies scope and misses the emphasis on keeping the protection active and unmodified by users.