5.1 Anti-malware processes and roles
Requirement 5.1 asks for current policies and procedures for protecting systems and networks from malware, and documented roles for running anti-malware and anti-phishing controls.
Requirement 5 Protect against malicious software
Requirement 5 covers anti-malware and anti-phishing protection for systems and personnel in scope. Each page covers one second-level requirement.
5.2 Malware prevention and detection
Requirement 5.2 requires anti-malware on all system components except those formally evaluated as not at risk, with that evaluation repeated at a frequency the entity sets through a targeted risk analysis.
5.3 Anti-malware operation and monitoring
Requirement 5.3 keeps anti-malware active and current: automatic updates, periodic or real-time scanning or behavioral analysis, scanning of removable media, retained audit logs, and protection against users disabling it.
5.4 Anti-phishing mechanisms
Requirement 5.4 requires processes and automated mechanisms that detect and protect personnel against phishing, separate from the security awareness training on phishing required in 12.6.3.1.
