Certification allows you to form a chain of trust via providers who have had auditors validate and verify their security. When my company gets SOC2 audited, we don't have to audit AWS because AWS is also SOC2 compliant, and their business critical vendors are likewise or have been independently validated, etc. all the way down the chain.