VM-11—Enterprise Antivirus Scope

>Control Description

Vulnerability scans are periodically performed on systems that do not require anti-virus; management determines if anti-virus should be required on the system based on scan results and associated risk.

Theme

Process

Type

Corrective

Policy/Standard

Vulnerability Management Policy

>Implementation Guidance

1. Ensure a process is defined and documented to perform vulnerability scans on all systems. 2. Ensure the process identifies systems on which antivirus should be deployed.

>Testing Procedure

1. Inspect and validate a process is defined and documented to perform vulnerability scans on all systems. 2. Validate whether the scan identifies systems on which antivirus should be deployed.