Policy 10 — Anti-Malware Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 10. Values shown as [X] are placeholders still to be set.

Purpose

To protect Revique systems from malicious software through deployed, current anti-malware and threat-detection controls.

Scope

Applies to all susceptible systems and workloads, including servers, endpoints, and containers.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Anti-malware or equivalent threat-detection must be deployed on all susceptible systems.

2Anti-malware definitions and engines must be kept current and updated automatically where possible.

3For workloads where traditional agents don't apply (e.g. serverless/containers), compensating controls such as image scanning and runtime threat detection must be used.

4Anti-malware logs must be retained for at least [X] months.

5Anti-malware mechanisms must not be disabled by users without authorization.

Roles & responsibilities

Role	Responsibility
Security Officer	Define anti-malware standards and review coverage.
DevOps / IT	Deploy and maintain anti-malware controls.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→