A company stores credit card information in a database. Access to this database is protected with strong authentication and authorization controls. What additional measure should be implemented to protect the data?

Encrypting the credit card data in the database.

Implementing a firewall to protect the database.

Conducting regular vulnerability assessments on the database.

Implementing physical access controls to the server room.