PCI DSS Requirement 5: Malware Protection

Requirement 5 of PCI DSS asks you to protect every system in your card data environment from malware. In practice that means running anti-malware software that stays up to date on its own, scans automatically, keeps logs, and can't be switched off by ordinary users. It also asks you to protect your staff from phishing. A system can go without anti-malware only if you have evaluated it, written down why it is not at risk, and you recheck that decision on a regular schedule.

Which systems need anti-malware?

All of them, by default. Requirement 5.2.1 says an anti-malware solution must be deployed on all system components, except those that a documented evaluation under 5.2.3 shows are not at risk from malware. That includes Windows desktops and servers, Macs, and Linux servers. Being a Linux system is not an exemption on its own. The exception is meant for systems where malware is genuinely unlikely, and you have to back it up in writing. Requirement 5.2.3 asks for a list of those systems, a look at how malware threats against them are changing, and a regular check that they still don't need protection.

What does the anti-malware software have to do?

Requirement 5.2.2 says it must detect all known types of malware and remove, block, or contain them. That covers viruses, worms, trojans, ransomware, spyware, keyloggers, and rootkits. Requirement 5.3.1 says it must stay current through automatic updates. Requirement 5.3.2 says it must either run periodic scans plus active or real-time scanning, or use continuous behavioral analysis of systems or processes, which is what most endpoint detection and response (EDR) tools do. Requirement 5.3.4 says its audit logs must be turned on and kept as Requirement 10.5.1 describes. That means at least twelve months of history, with the most recent three months available right away.

Can staff turn anti-malware off?

Not on their own. Requirement 5.3.5 says users can't disable or change the anti-malware software unless management specifically documents and approves it, case by case, for a limited time. A developer who needs it off for an hour to test something can get that approval in writing. A team that finds it slows down their laptops can't just switch it off. Set the software so only administrators can change it, and keep a record of every approved exception.

What became mandatory after 31 March 2025?

Four parts of Requirement 5 were best practice until 31 March 2025 and are now required. Requirement 5.2.3.1 asks you to decide how often you re-evaluate the systems that run without anti-malware, using a targeted risk analysis under Requirement 12.3.1. Requirement 5.3.2.1 does the same for how often periodic malware scans run, if that is the method you use. Requirement 5.3.3 says removable media, such as USB drives, must be scanned automatically when connected, or covered by continuous behavioral analysis. And Requirement 5.4.1 asks for processes and automated mechanisms that detect phishing and protect staff from it.

What does the anti-phishing requirement mean in practice?

Requirement 5.4.1 is about stopping phishing emails with technical controls, not just teaching people to spot them. The PCI DSS guidance points to things like anti-spoofing controls such as SPF, DKIM, and DMARC, link scanning, and server-side anti-malware that checks mail before it reaches the inbox. Business email services such as Microsoft 365 and Google Workspace include filtering of this kind, but check that it is turned on and set up for every mailbox. Publishing a DMARC record for your domain also makes it harder for an attacker to send email that looks like it came from you. Phishing awareness training is a separate requirement, 12.6.3.1, and doesn't replace the technical controls.

Does anti-malware catch a card skimmer on my checkout page?

Usually not. A web skimmer is malware, but it is a few lines of JavaScript added to your payment page or to a script the page loads, and it runs in the shopper's browser rather than as a program on your server. Server anti-malware often misses it, and an ASV scan doesn't look for it either. That is why PCI DSS v4.0 added Requirements 6.4.3 and 11.6.1, which ask you to keep an inventory of the scripts on your payment page and to detect unauthorized changes to it. Our guide to your payment page and Requirement 6.4.3 explains how that works. ServerScan's quarterly ASV scans under Requirement 11.3.2 cover the other side of the problem: the outdated software and exposed services attackers use to get malware onto a system in the first place. The pricing page shows what a plan includes, and Requirement 6 covers the patching that closes those holes.

Go on to Requirement 6 - Secure Systems.

Go back to Requirement 4 - Data Encryption.