I'd also be interesting in knowing why you are storing Credit Card information instead of using a service (there are few out there) to handle credit card transactions so you don't have to store that information.
We are B2B organisation and our customers require us to periodically charge them, based on their settings, e.g. account number, credit card number or other meanings (industry's special credit cards)
This is often a violation of CC/PCI principles unless you explicitly get certified to do this. A loss of data or a complaint could get you removed from your bank for processing transactions.
I would ensure that your company actually understands the implications of storing a CC number.
I believe they did, hence my focus is on the actual solution.