The Transparent Data Encryption (TDE) keystore is backed up using RMAN.

Vendor-specific media management software can be used for making encrypted RMAN backups to media.

The BACKUP BACKUPSET command can encrypt and decrypt backup sets.

Image copies can be encrypted.

Keystore-based encryption is the default mode for RMAN backup encryption.

Backup encryption can be enabled selectively for specific tablespaces.