Which two compliance frameworks require that data be encrypted when it is transmitted over a public network? (Choose two.)

The Payment Card Industry Data Security Standard (PCI DSS) explicitly requires encryption of cardholder data when transmitted across open, public networks, specifically citing Strong Cryptography and security protocols like TLS. This protects sensitive payment information during transit.

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect the privacy of consumer financial information, but it is less prescriptive about specific technical controls like encryption over public networks compared to PCI DSS or HIPAA.

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires that covered entities and business associates implement technical safeguards to protect electronic protected health information (ePHI), which includes encrypting ePHI when it is transmitted over an electronic network. This ensures patient data confidentiality.

The Sarbanes-Oxley Act (SOX) focuses on corporate governance and financial reporting accuracy, requiring internal controls, but it does not specifically mandate data encryption for public network transmission as a direct technical control.

COBIT is an IT governance framework that provides guidance on IT management, but it is not a regulatory compliance framework that directly mandates technical controls like data encryption for public network transmission.