This document discusses approaches to data protection beyond basic PCI compliance. It presents case studies of organizations using encryption to protect credit card data across various systems. It evaluates options like encryption, tokenization, and monitoring and argues a risk-adjusted approach is best. Centralized key management and policy can provide control while balancing security, performance and transparency across different data types and environments like cloud.