Which statement reflects the requirement for encrypting CHD transmissions?

• A. Security policies for encrypting CHD transmissions are documented, in use, and known to affected parties.
• B. Encryption policies are optional and only need to be drafted.
• C. Policies must be kept in a locked cabinet.
• D. Only the IT manager needs to know.

Answer: (A)

PCI DSS requires a formal policy that governs how cardholder data is protected in transit, and that policy must be documented, put into practice, and communicated to those who handle or are affected by it. The statement is the best fit because it captures both the need for documented rules and for those rules to actually be used and understood by the people responsible for implementing them. When encryption of CHD transmissions is covered by a documented policy that is actively used, it creates clear expectations, roles, and procedures, and it makes compliance auditable.

This goes beyond just having encryption methods in place; it ensures there is an authoritative guide that people follow, and that those affected by the policy are aware of it. The other options fall short because encryption policies being optional, stored in a locked cabinet, or known only to the IT manager do not guarantee that encryption is consistently applied, properly managed, or communicated to all who need to know.