API 1164 DE.CM-4: DE.CM-4 Malware risk assessed per environment and detection deployed and updated per vendor practice

The plan must require a risk assessment, using the API 1164 impact assessment, of the exposure of each segregated environment (production, test, development) to malware, malware detection mechanisms deployed and updated according to manufacturers', suppliers' and integrators' recommended practices, and detection employed according to each asset's technical capability and the risk its essential functions face and within each zone.