Ok so assuming you have enabled encryption and then have a disaster on the BE server itself. If you then need to restore data afterwards you may need one or all of the following:
1) Details (documentaion) of the passphrases used to create the encryption keys (including dates/timeframes of use and jobs used with) - it is the reponsibility fo the backup admin to maintain these in a secure location (not with your backup storage media)
2) A regular up to date copy of the Backup Exec Database. This database, amongst other things, contains the encryption keys used by your jobs, again kept somewhere safe and not with your backup media.
3) For any given install a one-off export of the Databse Encyption Key (DEK) for the Backup Exec Database, again copied to somewhere safe, and do not rename this file as the orginal name is required to use it when recovering the BEDB. The DEK is responsible for the encrypted security information inside the BEDB so without it the copy of the BEDB (point 2) is useless. This should be kept somewhere safe but ideally NOT with the copy of the BEDB and not with your backup media.
In theory in the event of a disaster you could get away with either point 1 OR Point 2 combined with 3 , best practice though is maintain all 3 key factors.
As a side note, you of course also need to secure the media itself, the server and for efficiency in the event of a disater copies of your catalogs - although these points are not directly related to encryption
