You can encrypt CMSADM backups. Run /cms/install/bin/backup -h to view the available backup options. For example:
[root@cmsvm12 x]# /cms/install/bin/backup -h
/cms/install/bin/backup options:
-b batch mode : no interaction
-E Skip encryption
-t Tape backup device (equivalent to answering 1 to 'Choose a backup device' prompt)
-o Other backup device (ie, not tape) (equivalent to answering 2 to 'Choose a backup device' prompt)
-p /full/path/of/backup/location - implies device is other (not tape) - do not specify a tape device
-s /path/to/passphrase-file - supply passphrase for GPG encryption without interactive prompting
-h Print this message and quit.
[root@cmsvm12 x]# /cms/install/bin/backup -p /backup -s /root/secret