If the deployed solutions use an HSM (Hardware Security Module) to protect private keys, back up the device using the tools provided by the HSM vendor.
If you previously ran the clusterctl backup create command, you do not need to back up HSM-protected keys. The backup file generated by the command includes these keys.