I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free versions.

With the expansions 3.0 it appears that sites will need a full blown AV product unless there is a product out there which has the policy controls ( I don't know of any free ones).

Anyone have clients running free AV and meet this for 2.0 or 3.0?

2 Answers 2


There isn't anything inherently wrong with using a free antivirus product for PCI, but you really need to consider your centralized logging. You can't keep the logs for your antivirus strictly on the local workstation and meet the retention requirements.

  • Central logging is a good point. You might be able to rig something up with shipping logs to a collector.
    – schroeder
    Jul 21, 2014 at 18:42
  • @schroeder precisely my thought. :) Jul 21, 2014 at 19:05

PCI-DSS provides guidance, not product recommendations. It is up to you to decide how to protect yourself under the guidance of PCI-DSS.

As such, free versions of AV can be adequate. But you have to determine it's best fit for your environment, and the risks and threats you have identified. Please do not use AV as a 'check the box' solution.

v3 section 5.2 does not seem to indicate a 'full-blown' solution, just one that cannot be disabled or altered by users. If your users do not have admin access, then you might be able to accomplish that using free AV software.

  • I wasn't really looking for a check the box solution, Req 5 is specific to anitvirus and I get a lot of questions from sales about using free AV. I guess from a security perspective I don't really know how I feel about it. I was looking at v3 as a policy based solution but re-reading it yeah limiting admin rights might be the best way. Jul 21, 2014 at 17:45
  • Along with Tim's answer, you might have to cobble together a compliant setup with free AV, but it should be possible, with the right software.
    – schroeder
    Jul 21, 2014 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .