Although the standard has already specified that the
anti-virus has to be able to protect systems,
detect malware, and prevent malware from running,
requirement 5.3 wants to make sure that it's actually running,
and if you think this sounds a bit unnecessary or even a bit strange,
Jacob and I talk about the reason this requirement exists
in our chat at the end of the module.
The requirement has three parts.
Firstly, that the anti-virus is active, and by this we mean continuously running.
Secondly,
that users cannot stop the anti-virus software running
or change the configuration settings.
And finally, requirement 5.3 offers an exception if ever there's a genuine need,
and the emphasis is on genuine need to disable anti-virus.
That exception needs to be authorized by management,
it has to happen for a documented reason,
and it has to be time limited.
You can't have a manager authorize anti-virus software from
being permanently disabled on a system, and especially,
and if you've been in this place as running an IT team,
especially not their own system, and again,
the QSA is going to check the policy, the sample of systems,
and the central anti-virus management console.
They're going to interview users and administrators to make
sure that software can't be disabled, and honestly,
although it's not in the formal testing procedures,
if you do have a process for anti-virus software to be disabled for specific
and time-limited reasons and that this process is being used,
the QSA is going to look for records of that management authorization.