Framework № PCI DSS 4.0 от 01.03.2022

5.3.2
Defined Approach Requirements: 
The anti-malware solution(s):

OR

Customized Approach Objective:
Malware cannot complete execution. 

Defined Approach Testing Procedures:

Purpose:
Periodic scans can identify malware that is present, but currently inactive, within the environment. Some malware, such as zero-day malware, can enter an environment before the scan solution is capable of detecting it. Performing regular periodic scans or continuous behavioral analysis of systems or processes helps ensure that previously undetectable malware can be identified, removed, and investigated to determine how it gained access to the environment. 

Good Practice:
Using a combination of periodic scans (scheduled and on-demand) and active, real-time (on-access) scanning helps ensure that malware residing in both static and dynamic elements of the CDE is addressed. Users should also be able to run ondemand scans on their systems if suspicious activity is detected – this can be useful in the early detection of malware. 
Scans should include the entire file system, including all disks, memory, and start-up files and boot records (at system restart) to detect all malware upon file execution, including any software that may be resident on a system but not currently active. Scan scope should include all systems and software in the CDE, including those that are often overlooked such as email servers, web browsers, and instant messaging software. 

Definitions:
Active, or real-time, scanning checks files for malware upon any attempt to open, close, rename, or otherwise interact with a file, preventing the malware from being activated. 

5.3.2.1
Defined Approach Requirements: 
If periodic malware scans are performed to meet Requirement 5.3.2, the frequency of scans is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1. 

Customized Approach Objective:
Scans by the malware solution are performed at a frequency that addresses the entity’s risk. 

Applicability Notes:
This requirement applies to entities conducting periodic malware scans to meet Requirement 5.3.2. 
This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment. 

Defined Approach Testing Procedures:

Purpose:
Entities can determine the optimum period to undertake periodic scans based on their own assessment of the risks posed to their environments.