What it asks for. Organisations must deploy anti-malware protection on system components in the cardholder data environment and connected systems, keep it current and active, and protect people against phishing. Where a system is judged not at risk from malware, that judgement must be documented and periodically re-evaluated.
In practice. Doing this well means anti-malware or endpoint detection runs on every in-scope system that can be affected, receives automatic updates, performs scans or continuous behavioural analysis, and cannot be disabled by ordinary users. Removable media is scanned or controlled, logs from the tooling feed central monitoring, and technical controls such as email filtering reduce phishing exposure. An assessor will expect configuration exports, update and scan evidence, the list of systems considered not at risk with the reasoning behind it, and a targeted risk analysis where periodic scan frequency is chosen by the organisation.
Common gaps. Typical failures are servers or appliances left without protection because they were assumed safe, users or administrators able to switch agents off, and stale risk evaluations for excluded systems. Anti-phishing is often treated as awareness training alone, without technical measures.