Which PCI DSS requirement covers protecting all systems against malware and regularly updating anti-virus software?

Which PCI DSS requirement covers protecting all systems against malware and regularly updating anti-virus software?

• A. Protect all systems against malware and regularly update anti-virus software or programs
• B. Develop and maintain secure systems and applications
• C. Restrict access to cardholder data by business need to know
• D. Maintain a policy that addresses information security for all personnel

Answer: (A)

Focus on protecting systems from malware and keeping anti-virus up to date. This is exactly the control described in PCI DSS as Requirement 5: you must protect all systems against malware and regularly update anti-virus software or programs. The emphasis here is on preventing malware infections across all system components and ensuring signatures and definitions are kept current, which is essential because new threats emerge continually. The other areas cover different controls: one pertains to secure systems and applications, including secure development and patching; another addresses restricting who can access cardholder data; and another establishes an information security policy for personnel. While all are important, they do not specifically capture the malware protection and anti-virus update requirement.

Focus on protecting systems from malware and keeping anti-virus up to date. This is exactly the control described in PCI DSS as Requirement 5: you must protect all systems against malware and regularly update anti-virus software or programs. The emphasis here is on preventing malware infections across all system components and ensuring signatures and definitions are kept current, which is essential because new threats emerge continually.

The other areas cover different controls: one pertains to secure systems and applications, including secure development and patching; another addresses restricting who can access cardholder data; and another establishes an information security policy for personnel. While all are important, they do not specifically capture the malware protection and anti-virus update requirement.