Which statement best aligns with the upgrade guidance for SSL/early TLS?

Which statement best aligns with the upgrade guidance for SSL/early TLS?

• A. To reduce risk, organizations should upgrade from SSL/early TLS to a strong protocol as soon as feasible.
• B. The upgrade is optional.
• C. The upgrade is never required.
• D. The upgrade should occur only after a security breach.

Answer: (A)

Upgrading to a strong protocol promptly reduces risk to cardholder data by using modern encryption and safer handshake methods. SSL and early TLS have known vulnerabilities and are no longer considered PCI-compliant. The correct approach is to migrate to a strong protocol, such as TLS 1.2 or TLS 1.3, as soon as feasible to protect data and meet security requirements. Treating the upgrade as optional, never required, or something to do only after a breach would leave systems exposed and ignore the mandatory security standards that require disabling SSL and early TLS.

Upgrading to a strong protocol promptly reduces risk to cardholder data by using modern encryption and safer handshake methods. SSL and early TLS have known vulnerabilities and are no longer considered PCI-compliant. The correct approach is to migrate to a strong protocol, such as TLS 1.2 or TLS 1.3, as soon as feasible to protect data and meet security requirements. Treating the upgrade as optional, never required, or something to do only after a breach would leave systems exposed and ignore the mandatory security standards that require disabling SSL and early TLS.