PCI version 3 section 5.3 states

Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period.

Is there a definition in PCI of "users"? Or is that left for us to define in our security policy?

Strictly speaking everyone who interacts with the system is a "user" but some users will also be administrators with the ability to change the group policy for the anti-virus system.


Is there a definition in PCI of "users"?

No. The DSS freely uses the term in 212 places (as of version 3.1.2), but it doesn't define the term. It also references employees as users, merchants as users, service providers as users, etc., so context matters. It is left to the interpretation of the QSA and the organization, and there's probably an expectation of common sense.

In relation to your specific question - 'Administrator' users who could disable anti-virus - one definition of an Administrator is someone who has the power to do things they're not supposed to do. Detective controls and threat of disciplinary action are expected to keep users with Administrative access from abusing it.


Actively running anti-virus mechanisms in a centralized environment should and can be configured as a domain policy or AV centralized policy so that no user can alter them, including users with administrative privileges on their own stations. A good AV policy can also completely control the firewall settings of the client stations.

Only the authorized by management personnel (the administrators of the anti-virus systems) should be able to alter such a policy (and only they can do it in a proper setup environment).

So the term 'users' refers to anyone except those designated anti-virus administrators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.