Yes, like PCI-DSS requirement 5. (required if you handle credit card numbers).
Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs
Malicious software, commonly referred to as “malware”—including viruses, worms, and Trojans—enters the network during many business approved
activities including employee e-mail and use of the Internet, mobile computers, and storage devices, resulting in the exploitation of
system vulnerabilities. Anti-virus software must be used on all systems commonly affected by malware to protect systems from current and
evolving malicious software threats. Additional anti-malware solutions may be considered as a supplement to the anti-virus software; however,
such additional solutions do not replace the need for anti-virus software to be in place.
5.1 Deploy anti-virus software on all
systems commonly affected by malicious
software (particularly personal computers
and servers).
5.1.1 Ensure that anti-virus programs
are capable of detecting, removing,
and protecting against all known types
of malicious software.
5.1.2 For systems considered to be not
commonly affected by malicious
software, perform periodic evaluations
to identify and evaluate evolving
malware threats in order to confirm
whether such systems continue to not
require anti-virus software.
5.2 Ensure that all anti-virus mechanisms
are maintained as follows:
Are kept current,
Perform periodic scans
Generate audit logs which are
retained per PCI DSS Requirement
10.7.
5.3 Ensure that anti-virus mechanisms
are actively running and cannot be
disabled or altered by users, unless
specifically authorized by management
on a case-by-case basis for a limited
time period.
Note: Anti-virus solutions may be
temporarily disabled only if there is
legitimate technical need, as authorized
by management on a case-by-case
basis. If anti-virus protection needs to be
disabled for a specific purpose, it must
be formally authorized. Additional
security measures may also need to be
implemented for the period of time during
which anti-virus protection is not active.
5.4 Ensure that security policies and
operational procedures for protecting
systems against malware are
documented, in use, and known to all
affected parties.