No, that is not correct. If you have three separate posture policies with identical conditions (ID group, operating system, other conditions) but distinct requirements (AV, Anti-spyware, Anti-Malware), a client must typically satisfy all applicable policies to be marked as compliant. Posture policies are generally evaluated conjunctively, meaning all defined conditions and requirements within the scope of the client must be met for overall compliance, unless the policy system explicitly offers an "OR" logical grouping option for requirements, which is not the standard behavior for independent policies.
