What is the primary purpose of a formal Risk Mitigation and Migration Plan for SSL/early TLS usage?

• A. To outline steps to migrate to strong protocols
• B. To document past vulnerabilities only
• C. To schedule unrelated system upgrades
• D. To ignore ongoing risks

Answer: (A)

The main idea here is to actively reduce risk by having a clear path to strengthen SSL/TLS usage. A formal Risk Mitigation and Migration Plan outlines the concrete steps, timeline, and who is responsible for moving away from weak protocols (like SSL and early TLS) toward stronger ones, such as TLS 1.2 or 1.3. It also covers validating configurations, updating cipher suites, cert management, testing in controlled environments, and having rollback options if something doesn’t work. This plan turns risk into actionable tasks and milestones, ensuring the changes actually improve security and maintain compliance, rather than merely noting that vulnerabilities exist. The other options would either focus on past issues, trigger unrelated upgrades, or suggest ignoring risk, which wouldn’t achieve the goal of reducing exposure.