Tape is an important part of organizations’ business continuity programs. However, since tape is portable, all of its contents − if not encrypted − are subject to exposure. Additionally, because tape is such a dense media, the risk associated with loss (and subsequent data exposure) can be substantial. A recent study by Ponemon Institute indicated that the average cost to a company per data breach incident in 2007 was $6.3 million, and that the primary technology measure enacted after a breach was increased use of encryption. Organizations must implement practices to ensure the security of its tapes’ contents.

In order to gain more insight into tape encryption, this document will examine the following questions:

• What exactly is encryption?
• Which data should be encrypted?
• Why not encrypt all data?