An IR ticket summarizer must not send cardholder data to a cloud LLM. Which control best prevents that disclosure?

Redacting cardholder data from ticket text before sending it to the cloud LLM is the control that best prevents an IR ticket summarizer from disclosing PAN-related data to an external model. Redaction removes or masks sensitive fields at the boundary before inference so the cloud LLM never receives cardholder data it does not need to summarize incident narrative. For municipal IR workflows with possible payment-card fields in tickets, that pre-send minimization reduces PCI-aligned disclosure risk.

Encoding cardholder data with Base64 encoding before sending it to the cloud LLM fails because Base64 is only reversible encoding, not removal; the cloud LLM still receives and can decode the full cardholder data, so the disclosure to the external model still occurs. Tagging cardholder data with NER tags but keeping it before sending it to the cloud LLM fails because the model still receives the sensitive data during inference — adding tags does not remove it and does not undo the disclosure that already occurred. Scrubbing cardholder data from retrieved articles before sending it to the cloud LLM fails because it cleans the wrong source; retrieved articles are not the ticket text, so cardholder data in the IR ticket itself would still be sent to and processed by the cloud model.

Exam caveat: When the stem says the summarizer must not send cardholder data to a cloud LLM, redaction must happen on the ticket text before the data reaches the model — not as scrubbing retrieved articles which leaves ticket cardholder data in place and not as tagging cardholder data with NER tags but keeping it for the model to still receive.

Operational check: Before cloud summarization, run DLP/redaction for PAN and related cardholder fields on IR tickets, submit a redacted ticket (summary succeeds without PAN), attempt an unredacted send (blocked), and confirm redaction happens prior to the model call, not as scrubbing retrieved articles while the ticket still contains PAN.