Which statement accurately describes handling of insecure protocols in documentation?

Which statement accurately describes handling of insecure protocols in documentation?

• A. Provide documentation and business justification for the use of all insecure protocols, and describe security features implemented.
• B. Ignore insecure protocols as long as encryption is used elsewhere.
• C. Record insecure protocols without justification.
• D. Remove all insecure protocols immediately.

Answer: (A)

When you have insecure protocols in use, the important practice is to identify them, justify why they’re needed, and specify what security controls are protecting cardholder data as compensating measures. This shows you’re actively managing risk rather than ignoring it, and it provides auditors with clear evidence of due diligence and plan for remediation. Providing documentation along with a business justification and describing the security features implemented is the best approach because it acknowledges the risk and demonstrates that you’ve put in place concrete measures to mitigate it. It also aligns with the PCI mindset that any exception to preferred secure protocols should be documented, justified by business needs, and accompanied by compensating controls such as encryption in transit, strong access controls, monitoring, and network segmentation. The other ideas fall short because they either ignore the risk (relying on encryption elsewhere or assuming removal isn’t necessary), or skip the required justification. Immediate removal is ideal, but not always feasible in every situation; documentation with justification and controls provides a practical path that still protects cardholder data while planning for remediation.

When you have insecure protocols in use, the important practice is to identify them, justify why they’re needed, and specify what security controls are protecting cardholder data as compensating measures. This shows you’re actively managing risk rather than ignoring it, and it provides auditors with clear evidence of due diligence and plan for remediation.

Providing documentation along with a business justification and describing the security features implemented is the best approach because it acknowledges the risk and demonstrates that you’ve put in place concrete measures to mitigate it. It also aligns with the PCI mindset that any exception to preferred secure protocols should be documented, justified by business needs, and accompanied by compensating controls such as encryption in transit, strong access controls, monitoring, and network segmentation.

The other ideas fall short because they either ignore the risk (relying on encryption elsewhere or assuming removal isn’t necessary), or skip the required justification. Immediate removal is ideal, but not always feasible in every situation; documentation with justification and controls provides a practical path that still protects cardholder data while planning for remediation.