We had a front desk that would take calls and pass info along to the appropriate staff (on a different, largely segregated network). We don't want people emaili

We had a front desk that would take calls and pass info along to the appropriate staff (on a different, largely segregated network). We don't want people emailing CC numbers or any customer data, really, internally, so it would be passed along via a note. But these cases rarely ever came up. We work with transaction numbers and 99% of staff has zero reason to know any credit card information. It was something the auditors just brought up on their own, so yeah, I'm assuming they'd run into it before.