And many certifications demand a specific architecture and don't focus on technical standards/algorithms. Like who can access data, is access audited, are applications and databases separated, stuff like that