5.2.3Malicious software (malware) is prevented, or detected and addressed

Defined Approach Requirements:

Any system components that are not at risk for malware are evaluated periodically to include the following:

- A documented list of all system components not at risk for malware.

- Identification and evaluation of evolving malware threats for those system components.

- Confirmation whether such system components continue to not require anti-malware protection.

Defined Approach Testing Procedures:

5.2.3.a Examine documented policies and procedures to verify that a process is defined for periodic evaluations of any system components that are not at risk for malware that includes all elements specified in this requirement.

5.2.3.b Interview personnel to verify that the evaluations include all elements specified in this requirement.

5.2.3.c Examine the list of system components identified as not at risk of malware and compare to the system components without an anti-malware solution deployed per Requirement 5.2.1 to verify that the system components match for both requirements.