Which of these statements about the PCI-DSS requirements for any company handling, processing or transmitting credit card data is true?

A. Muti-factor authentication is required for all new card holders

B. All employees with direct access to cardholder data must be bonded

C. Cardholder data must be encrypted if it is sent across open or public networks

D. Some form of mobile device management (MDM) must be used on all mobile credit card processing devices