Which information requires encryption in transit and at rest?

• A. Public press releases only.
• B. Personal data, financial information, and any sensitive company data per policy.
• C. Only password data.
• D. Non-sensitive marketing material.

Answer: (B)

Protecting data depends on keeping it confidential both while it’s moving and while it’s stored. Encryption in transit guards information as it travels across networks, preventing eavesdropping or tampering, while encryption at rest protects data when it’s stored on disks, backups, or other storage so unauthorized access doesn’t reveal it.

Personal data, financial information, and any data the policy marks as sensitive are the kinds of information that, if leaked, could cause real harm or violate laws and policies. That’s why they’re the ones that require encryption in both states. Public press releases are intended for broad access, so encryption isn’t about protecting their contents. Password data is important, but focusing only on passwords misses other sensitive data that also needs protection. Non-sensitive marketing material isn’t a risk area for confidentiality, so encryption isn’t required there.