The requirements of PCI DSS vulnerability management are not particularly obtuse, but a checklist is nonetheless helpful. Using one ensures that you cover the seven points that the payment card industry would check if they inspected your network. This list addresses the same forms of malware: worms, viruses, and Trojans. It is meant as a continued complement to the checklists for network security, credit card data storage, and credit card data transmission. As with those checklists, the point of this checklist for PCI DSS vulnerability management is practical network security. With that said, here's the list.
The checklist consists of two points to complement the requirements for vulnerability management. But it goes further, spelling out in (sweeping) detail precisely what is expected.
For a sample of system components including all operating system types commonly affected by malicious software, verify that anti-virus software is deployed if applicable anti-virus technology exists.
For a sample of system components, verify that all anti-virus programs detect, remove, and protect against all known types of malicious software (for example, viruses, Trojans, worms, spyware, adware, and rootkits).
Obtain and examine the policy and verify that it requires updating of anti-virus software and definitions.
Verify that the master installation of the software is enabled for automatic updates and periodic scans.
For a sample of system components including all operating system types commonly affected by malicious software, verify that automatic updates and periodic scans are enabled.
For a sample of system components, verify that anti-virus software log generation is enabled and that such logs are retained in accordance with the PCI DSS requirements on monitoring and testing networks (Sec. 10.7).
It is widely known that Ubuntu Linux is impervious to Windows vulnerabilities usually exploited by viruses, worms, and Trojans, but this does not make it bullet-proof to all vulnerabilities. At the time of writing, there are thousands of vulnerabilities that are particular to various versions of various distributions of Linux. See the US National Vulnerability Database on Linux vulnerabilities. Additionally, you can get a security checklist for software used by the US government.
As stated, this checklist is not particularly long but is sweeping, usually involving every computer in a company. The hardest part, of course, is ensuring the security software is continuing to work and that it has not been compromised. That is addressed in the second requirement of PCI DSS vulnerability management.