The last requirement, requirement 5.4, as with all the requirements,
demands that the organization complying with PCI DSS has the
appropriate policies and procedures in place.
They need to be written down, made available to everyone who needs them,
and most importantly, in use.
So the QSA is going to check the policies and procedures,
they're going to interview the people who are supposed to
know where the policies and procedures are,
and that they're being followed.
We've reached the end of requirement 5,
so now Jacob and I discuss some of the practicalities associated with
this requirement including dedicated operating systems that may not
need anti-malware or anti-virus software,
whether it's okay to use free anti-virus software,
and whether application and white-listing meets the intent and
the actual specifics of this requirement.