All service providers with existing connection points to POS POI terminals that use SSL and/or early TLS must have a formal Risk Mitigation and Migration Plan in place.

• A. Maybe
• B. True
• C. False
• D. Not Applicable

Answer: (B)

SSL and early TLS are considered weak for protecting cardholder data in transit. For service providers that have existing connection points to POS/POI terminals using those protocols, a formal risk mitigation and migration plan is required to manage and document the move to stronger encryption, such as TLS 1.2 or higher. This plan identifies all affected components, assigns priorities, sets milestones, and outlines testing and validation steps before the migration is complete. The goal is to control the transition, ensure timely remediation, and maintain ongoing security monitoring to prevent data exposure during and after the upgrade.