Certifications are used to ensure a minimal level of guaranteed security: They are often limited to components of a system, not the entire system. So if a component is secure, the weak link could be ...

Encrypted data does not have to be protected, but the keys used to encrypted/decrypt the data have to be protected. It’s possible to encrypt keys, but the keys used to encrypt the keys must be ...