I agree with Ron. The "Lightning Risk Analysis" (LRA) to which he refers essentially looks at two things: (1) How likely is it that lightning will strike the structure? and (2) How serious would it be if lightning did strike the structure?
For item (1), the LRA has you consider how often lightning strikes occur in that area of the country. There is a map that shows strike frequency. You also consider the shape of the building (i.e., tall buildings get hit more often that short ones) and what else is in the area (i.e., lightning is less likely to strike your building if there are taller buildings or tall trees nearby).
For item (2), the LRA has you consider what is inside the building, and rate its importance. For example, a lightning strike on an elementary school, a gas station, or a hospital might be more of a concern than one on a restaurant, a bookstore, or a car repair shop.
The process has you calculate and compare two numbers. Depending on which of the two is larger, the LRA results say either that lightning protection is recommended or that it is not warranted. It does not say that one is "required," as Ron mentioned.
