If SSL or early TLS is used, what must be completed?

If SSL or early TLS is used, what must be completed?

• A. Appendix A2 testing procedures.
• B. Implementation of non-secure configurations.
• C. Disabling TLS entirely.
• D. No additional steps required.

Answer: (A)

SSL and early TLS are treated as insecure for protecting cardholder data in PCI DSS. When these protocols are still in use, you must carry out the testing procedures described in Appendix A2 to validate how this risk is managed and to provide evidence of how it’s being mitigated. Appendix A2 outlines the specific steps testers take to verify SSL/early TLS usage, confirm that weak configurations aren’t exposed to sensitive data, and document any compensating controls or migration plans toward TLS 1.2 or higher. In practice, this ensures the organization demonstrates due diligence in assessing residual risk and has a clear path to upgrading to modern, secure protocols.

SSL and early TLS are treated as insecure for protecting cardholder data in PCI DSS. When these protocols are still in use, you must carry out the testing procedures described in Appendix A2 to validate how this risk is managed and to provide evidence of how it’s being mitigated. Appendix A2 outlines the specific steps testers take to verify SSL/early TLS usage, confirm that weak configurations aren’t exposed to sensitive data, and document any compensating controls or migration plans toward TLS 1.2 or higher. In practice, this ensures the organization demonstrates due diligence in assessing residual risk and has a clear path to upgrading to modern, secure protocols.