Free guide · PCI DSS v4.0.1

PCI DSS Requirement 5.3.2 — Anti-malware scanning and behavioural analysis

Requirement 5.3.2 gives two acceptable ways to run an anti-malware solution: periodic scans combined with active or real-time scanning, or continuous behavioural analysis of systems and processes. Requirement 5.3.1 sits alongside it and requires the solution to be kept current through automatic updates.Timing: Applies in PCI DSS v4.0.1. Requirement 5.3.2.1, which sets scan frequency from a targeted risk analysis, is mandatory since 31 March 2025.

Find your SAQ All guides

Who it applies to

System components identified as at risk from malware

Entities completing SAQ C, SAQ D-Merchant or SAQ D for Service Providers

What Requirement 5.3.2 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

The anti-malware solution performs periodic scans and active or real-time scans, or performs continuous behavioural analysis of systems or processes.

The solution is kept current via automatic updates (Requirement 5.3.1).

Where periodic scans are used, the frequency is defined in a targeted risk analysis performed per Requirement 12.3.1.

Systems not considered at risk from malware are evaluated periodically to confirm that conclusion still holds.

Evidence an assessor expects

Anti-malware policy or configuration showing the scanning mode in use

Console output showing definition or engine currency across in-scope hosts

Scan or detection logs covering the assessment period

The targeted risk analysis supporting the chosen scan frequency

Common mistakes

Assuming Linux or container hosts are automatically out of scope without a documented periodic evaluation.

Real-time protection disabled on a subset of hosts for performance reasons, with no compensating control.

No evidence that definitions actually updated on every in-scope host, only that the feature is enabled.

Not sure whether Requirement 5.3.2 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.