You can create either a tokenization policy or a masking policy.
To configure tokenization policies, see Creating a Tokenization Policy
To configure masking policies, see Creating a Masking Policy
If you plan to manage Elliptic Curve Cryptography (ECC) keys in a Cryptographic Security Platform Vault for Cryptographic APIs that is protected by an nShield HSM, the ECC feature must be enabled on the HSM.