Yes, federal law requires all individuals and businesses, regardless of their size, to maintain a written information security plan.