Which Appendix addresses the additional PCI DSS requirements for entities using SSL/early TLS?

Which Appendix addresses the additional PCI DSS requirements for entities using SSL/early TLS?

• A. Appendix A1
• B. Appendix A3
• C. Appendix B
• D. Appendix A2

Answer: (D)

Appendices in PCI DSS are used to address extra requirements for specific situations. For organizations still using SSL or older versions of TLS, the dedicated guidance is in Appendix A2. This appendix provides the additional PCI DSS requirements that apply to those environments, emphasizing the need to migrate away from SSL and early TLS to modern TLS (typically TLS 1.2 or higher), disable weak cryptographic protocols and ciphers, and implement the corresponding controls to protect card data. It’s the best fit because it specifically targets SSL/early TLS scenarios; the other appendices cover different topics and do not address these encryption-timeline concerns.

Appendices in PCI DSS are used to address extra requirements for specific situations. For organizations still using SSL or older versions of TLS, the dedicated guidance is in Appendix A2. This appendix provides the additional PCI DSS requirements that apply to those environments, emphasizing the need to migrate away from SSL and early TLS to modern TLS (typically TLS 1.2 or higher), disable weak cryptographic protocols and ciphers, and implement the corresponding controls to protect card data. It’s the best fit because it specifically targets SSL/early TLS scenarios; the other appendices cover different topics and do not address these encryption-timeline concerns.