VSys comes with a single built-in encryption group: "BackgroundChecks". That encryption group is used by default in all screening-related certifications. To define additional encryption groups, from within the certifications setup tool, click on Encryption groups. To use any new encryption groups you define here you'll have to create master and user encryption keys, and then use the encryption group when adding fields to a certification.
Note that these encryption groups cannot be used in any version of VSys 2.4 or prior, or any version of GMS at all.