In the PCI DSS standard (v3.1), 4.1(i) reads:
For all other environments using SSL and/or early TLS: Review the documented Risk Mitigation and Migration Plan to verify it includes:
- Description of usage, including what data is being transmitted, types and number of systems that use and/or support SSL/early TLS, type of environment;
- Risk-assessment results and risk-reduction controls in place;
Description of processes to monitor for new vulnerabilities associated with SSL/early TLS;
Description of change control processes that are implemented to ensure SSL/early TLS is not implemented into new environments;
- Overview of migration project plan including target migration completion date no later than June 30, 2016.
However, in SAQ D this text is in 4.1(g) and there is no (i).
Why is there a difference?
I checked and this appears to be the same in v3.2 too (and also for the merchant SAQ-D).