Anti-virus and Malicious Code Policy Summary

Anti-virus and Malicious Code Policy Summary

• The purpose of this policy is to protect networks and information processing facilities from malicious software.
• The policy includes all information processing facilities and mobile computing devices under the control of the company.
• Roles and responsibilities include installing and updating approved anti-virus software, monitoring and responding to alerts, and educating users.
• Users are responsible for scanning suspicious emails and files, reporting viruses, and not disabling anti-virus software.
• Third-party vendors must provide updates and support as needed.
• Anti-virus software must proactively and periodically scan for viruses, scan new code before production, and scan files received from external sources.
• Workstations, laptops, and servers all require anti-virus protection.
• Laptops may need alternative arrangements for virus definition updates when operated away from the trusted network.
• Gateway virus scanning is needed to scan web traffic for malicious software.
• E-mail content scanning should be used to check all incoming and outgoing emails for viruses.
• Violation of the policy may result in disciplinary action, unless a valid business case is provided and approved.
• The policy is in line with the Payment Card Industry Data Security Standard.