For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified best-practices which recommend, demand or forbid anti malware programs (virus scanners).
I am also looking for published guidelines or interpretations on how are the terms interpreted by auditors.
(I added an self-answer with my findings so far, they should serve as an example and prove of effort)