Your business has decided to add credit card numbers to the data it backs up to tape. Which of the following represents the best practice your business should observe?

Refusing to back up credit card data or their hashes simply avoids the compliance challenge rather than addressing the stated business requirement and does not constitute a best practice.

Encrypting tapes sent off-site addresses only the physical transport risk and satisfies just one of many PCI-DSS controls required for stored cardholder data, making it an incomplete solution on its own.

Backing up hashes instead of actual PANs may reduce some risk but is not inherently PCI-DSS compliant for all backup scenarios, and implementing this without expert guidance risks non-compliance with the standard's full requirements.

Handling Primary Account Numbers (PANs) in backups triggers a broad set of PCI-DSS requirements covering encryption, cryptographic key management, access controls, audit logging, and retention policies. A qualified PCI security consultant or Qualified Security Assessor (QSA) can evaluate the full scope of applicable controls and ensure all requirements are met, preventing costly compliance failures and data breach liability that would result from implementing an incomplete solution.