A security administrator is implementing a new backup strategy. The organization requires that backups be encrypted at rest and that the encryption keys be managed separately from the backup data. Which of the following should the administrator implement to meet these requirements?