There are few businesses today that are not impacted by threats and risks. Information security needs to play a role in most aspects of your business, especially those that have regulatory or contractual obligations. This includes being assessed by those for whom you provide services and assessing your service providers.
Just Because You're Small Doesn't Mean Information Security is Not Necessary
Smaller organizations should not think that they are too small to be impacted by a data security problem. By understanding your business in a way that focuses on your customers and products, you can determine where your biggest risks can occur and where best to place your efforts to protect your and your customers' data.