Where requirement 5.1 is about selecting and
deploying competent anti-virus software,
requirement 5.2 wants to make sure that it's configured properly,
and as far as PCI DSS is concerned, properly means three things.
Firstly,
that the software is both getting updates of malware
definitions and is keeping itself, keeping its binaries up to date.
Secondly, that the software is set to undertake periodic scans,
and again, periodic not defined, but let's say weekly,
as well as on access scans.
And finally,
that the AV software has logging enabled and that the logs are
being generated and retained for 12 months,
and that's what requirement 10.7 asks for about log retention,
so 12 months log retention.
The QSA will look at policies,
but mostly they're going to look at the configuration of
the anti-virus on a sample of systems,
and they're probably going to look at a central management console,
so they'll look at the master configuration and status
reports on that central console.