I have seens a lot of companies without it, so it isn't a NEED. Just like basic computer security 🙂 Depends on the risks you are ready to accept.