Improve clarity of TLS version requirements in V9.1.3

I’ve been reviewing the V9 Communication Security section and noticed that requirement 9.1.3 still uses wording like “latest recommended versions” and lists both TLS 1.2 and TLS 1.3 as examples. This phrasing feels a bit outdated and can be interpreted in different ways depending on the assessor or the organisation.

Right now, the requirement doesn’t clearly state:

that TLS 1.3 should be the preferred protocol

when TLS 1.2 is still acceptable

that older versions (SSLv2, SSLv3, TLS 1.0, TLS 1.1) must be disabled

that TLS 1.2 should only be used with AEAD cipher suites

that TLS 1.3 cipher suites are fixed and don’t require manual selection

To make the requirement more actionable and aligned with current guidance (including the OWASP TLS Cheat Sheet), I’d like to propose updated wording.

Proposed update for 9.1.3
Verify that TLS 1.3 is enabled and preferred for all client communications. TLS 1.2 is permitted only when TLS 1.3 is not supported, and must be configured with AEAD cipher suites and secure renegotiation. Older protocol versions (SSLv2, SSLv3, TLS 1.0, TLS 1.1) must be disabled.

This keeps the requirement simple but much clearer, and it reflects the current state of TLS without being overly prescriptive.

Happy to adjust the wording based on feedback.

Start with the raw .md source for the V9 Communication Security section in the ASVS 5.0 branch and locate requirement 9.1.3. Compare its current wording with the proposed update and review the issue discussion before editing. Done means the requirement clearly states TLS 1.3 preference, TLS 1.2 conditions, and disabled older protocols.