What is required to ensure antivirus cannot be disabled or altered by users?

What is required to ensure antivirus cannot be disabled or altered by users?

• A. Antivirus logs must be retained
• B. Antivirus cannot be disabled or altered by users unless specifically authorized by mgmt on a case-by-case basis for a limited time period
• C. Antivirus is actively running
• D. Antivirus must be installed on all devices

Answer: (B)

Tamper resistance for security software and a formal exception process are essential. The strongest requirement is that antivirus cannot be disabled or altered by users unless management explicitly authorizes it on a case-by-case basis for a limited time. This creates an auditable control that prevents end users from turning off protection and ensures any temporary disablement is approved, time-bound, and supervised. It directly enforces continuous protection across systems, which is the core reason antivirus effectiveness depends on preventing user tampering and on controlled exceptions. While keeping logs is important for investigation, and having the software actively running or installed on all devices is necessary, those factors alone do not guarantee prevention of tampering. You can have logs, running status, and full deployment, but without a governance process that restricts user-initiated changes, protection can still be disabled without authorization.

Tamper resistance for security software and a formal exception process are essential. The strongest requirement is that antivirus cannot be disabled or altered by users unless management explicitly authorizes it on a case-by-case basis for a limited time. This creates an auditable control that prevents end users from turning off protection and ensures any temporary disablement is approved, time-bound, and supervised. It directly enforces continuous protection across systems, which is the core reason antivirus effectiveness depends on preventing user tampering and on controlled exceptions.

While keeping logs is important for investigation, and having the software actively running or installed on all devices is necessary, those factors alone do not guarantee prevention of tampering. You can have logs, running status, and full deployment, but without a governance process that restricts user-initiated changes, protection can still be disabled without authorization.