Short answer: yes. To achieve the certification, your organisation needs to carry out a detailed risk assessment of its infrastructure and data management. A number of the most common risks fall into the territory of cyber security and good data management.