Which requirement is explicitly described as protecting all systems against malware and regularly updating anti-virus software or programs?

Which requirement is explicitly described as protecting all systems against malware and regularly updating anti-virus software or programs?

• A. Encrypt transmission of cardholder data across open, public networks
• B. Do not use vendor-supplied defaults for system passwords and other security parameters
• C. Protect all systems against malware and regularly update anti-virus software or programs
• D. Restrict physical access to cardholder data

Answer: (C)

The main idea here is to guard every system that handles or can impact cardholder data from malicious software by using up-to-date antivirus protection. PCI DSS requires deploying anti-malware measures on all systems that could affect the security of cardholder data and keeping those defenses current with the latest virus definitions and program updates. This proactive layer helps prevent infections from spreading, stopping attackers from gaining a foothold or exfiltrating data. Think of it as the antivirus shield that must be present everywhere malware could reach the environment, not just on servers but on endpoints and other devices that process or access cardholder data. Regular updates are crucial because new malware variants appear constantly; without timely signature updates and software patches, even a system with antivirus could become vulnerable. Other options point to different controls—encrypting data in transit, changing default credentials, and restricting physical access. Each addresses a separate risk area (network protection, secure configurations, and physical security), but they don’t describe the explicit requirement to protect against malware with updated antivirus across all systems.

The main idea here is to guard every system that handles or can impact cardholder data from malicious software by using up-to-date antivirus protection. PCI DSS requires deploying anti-malware measures on all systems that could affect the security of cardholder data and keeping those defenses current with the latest virus definitions and program updates. This proactive layer helps prevent infections from spreading, stopping attackers from gaining a foothold or exfiltrating data.

Think of it as the antivirus shield that must be present everywhere malware could reach the environment, not just on servers but on endpoints and other devices that process or access cardholder data. Regular updates are crucial because new malware variants appear constantly; without timely signature updates and software patches, even a system with antivirus could become vulnerable.

Other options point to different controls—encrypting data in transit, changing default credentials, and restricting physical access. Each addresses a separate risk area (network protection, secure configurations, and physical security), but they don’t describe the explicit requirement to protect against malware with updated antivirus across all systems.