SSL and/or early TLS must not be introduced into environments where those protocols don't already exist.

• A. Not Applicable
• B. False
• C. True
• D. Maintained

Answer: (C)

SSL and early TLS are considered insecure for protecting cardholder data in transit, and PCI DSS requires moving away from them to stronger protocols (TLS 1.2 or higher). Introducing SSL or early TLS in an environment that doesn’t already use them would create a weak, noncompliant setup and undermine security, so the correct stance is that you must not introduce these protocols. In other words, the policy is to avoid insecure cryptography and ensure all communications use modern, strong TLS. Not applicable, false, or maintaining them would all misstate the PCI requirement, which is to disable and not bring back these legacy protocols.