What does PCI DSS require when cardholder data is sent via email?

• A.Cardholder data sent via email must be protected with strong cryptography, such as PGP or S/MIME encryption; however, sending PAN via email should be avoided when possible
• B.Emailed cardholder data is permitted in clear text on an internal mail relay, such as Exchange; however, external recipients need a password-protected PDF attachment sent in a separate message
• C.Emailed PAN must be masked to the first six digits, such as 411111; however, the last four digits must then be sent in a second unencrypted message
• D.Cardholder data sent via email is allowed with opportunistic transport, such as STARTTLS; however, the sender must archive each message in unencrypted form