Some industries must do security risk assessments by law, like those handling personal info or health data. This includes HIPAA, PCI-DSS, and others.