5.3.1 Anti-malware kept current through automatic updates

The anti-malware solution or solutions must be kept up to date by means of automatic updates, covering signatures, security updates, threat analysis engines and any other protections the solution relies on. Updates should come from a trusted source as soon as they are available; they may be pulled first to a central location, for example for testing, before rollout to individual components. Applicability: applies to every entity in scope, with no special notes. Objective under the customized approach: anti-malware mechanisms are able to detect and deal with the newest malware threats.

Source: PCI DSS v4.0.1, 5.3.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.