FTP security

I work for a company and they are concerned about FTP security, in the
fact that we send and recieve delicate information over the Internet. I
(a network admin student) said that we should use a VPN with IPSc. Am I
correct in this assumption?