I would also add "avoid it altogether" where practical. Using stripe or similar, for checkout, for example, and you don't have to ever touch a credit card number, CVV, etc.