Any business that must meet compliance regulations for information security. Any business that has access to the private personal information of their clients.  Any business that creates or possesses proprietary information or intellectual property.  Any business whose customers are publicly traded companies. Any business that could fail if its reputation were compromised or if it suffered an unexpected financial loss.