A financial services company is migrating customer credit card data to a cloud-based payment processing system. The security team must ensure that cardholder data is protected both when stored in the database and when transmitted between the payment gateway and third-party processors. Which combination of data protection methods should be implemented to meet PCI DSS compliance requirements?