Customer must have actively scanning and updated anti-virus software on all workstations and servers directly connected to the Internal network. PCI DSS 5, NIST 3.14.2, 3.14.4, 3.14.5