Which statement correctly describes the status of SSL and early TLS with respect to strong cryptography after 2016?

Which statement correctly describes the status of SSL and early TLS with respect to strong cryptography after 2016?

• A. SSL and early TLS are not considered strong cryptography after 2016; new implementations must not use SSL or early TLS.
• B. They remain considered strong cryptography and may be used indefinitely.
• C. They must be used only with a migration plan and no new implementations.
• D. They are recommended for compatibility with legacy systems.

Answer: (A)

After 2016, SSL and early TLS no longer meet the standard for strong cryptography in PCI DSS. Strong cryptography means using modern protocols such as TLS 1.2 or higher with robust cipher suites, and it explicitly excludes SSL and TLS 1.0/1.1. Because of this, new implementations must not use SSL or early TLS. Organizations should migrate existing systems that still rely on those protocols to TLS 1.2+. This ensures payment data is protected with up-to-date cryptography. The other options imply SSL/early TLS are still acceptable or recommended for compatibility, which PCI DSS does not permit.

After 2016, SSL and early TLS no longer meet the standard for strong cryptography in PCI DSS. Strong cryptography means using modern protocols such as TLS 1.2 or higher with robust cipher suites, and it explicitly excludes SSL and TLS 1.0/1.1. Because of this, new implementations must not use SSL or early TLS. Organizations should migrate existing systems that still rely on those protocols to TLS 1.2+. This ensures payment data is protected with up-to-date cryptography. The other options imply SSL/early TLS are still acceptable or recommended for compatibility, which PCI DSS does not permit.