You can add a layer of security to the sensitive data in CPQ using Salesforce Shield Platform Encryption. CPQ supports Salesforce Shield Platform Encryption with the following limitations:
Encryption for number fields is not supported
Encryption for account and contact is not supported