If you are a non-bank financial institution — an investment adviser, mortgage broker, insurance agency, tax preparer, lender or similar — very likely yes. It requires a written security program, risk assessment, specific technical controls and a qualified individual overseeing it.