If your business keeps a Social Security number, a driver’s license number, or a credit card or bank account number for even one Massachusetts resident, state law already expects you to have a written plan for protecting it. That plan is called a Written Information Security Program, or WISP, and the regulation behind it is 201 CMR 17.00. It’s one of the strictest data protection rules in the country, and it applies to far more businesses than most owners realize.
This article covers the essentials: who the rule applies to, why it matters, and what a compliant WISP looks like. When you’re ready to build yours, download our free 23-page guide and fillable WISP template.
What 201 CMR 17.00 Requires
201 CMR 17.00 took effect in 2010 under Massachusetts General Laws Chapter 93H. It sets minimum standards for anyone who “owns or licenses” personal information about a Massachusetts resident. In short, you must:
- Develop, implement and maintain a written information security program
- Put administrative, technical and physical safeguards in place that fit your size, resources and the amount of data you hold
- Meet specific computer security requirements, including encryption, secure authentication, access controls, current patches and malware protection
- Train employees, hold service providers to the same standards, and review the program at least once a year
Under the regulation, “personal information” means a person’s first name (or first initial) and last name together with any of these: a Social Security number, a driver’s license or state ID number, or a financial account or credit or debit card number.
Does It Apply to Your Business?
Almost certainly, yes. The regulation has no size, revenue or employee-count threshold. A sole proprietor is covered exactly like a large corporation. The only thing that changes with size is how elaborate your safeguards need to be.
Take a landscaping company with two employees who live in Massachusetts. To run payroll, the owner collects each employee’s Social Security number on a W-4 and maybe a bank account number for direct deposit. That alone puts the business under 201 CMR 17.00. It needs a WISP, even though it never stores a single customer card number.
The rule also follows the data, not your address. A company headquartered in New Hampshire, Rhode Island, Connecticut, New York or anywhere else is covered if it holds personal information about Massachusetts residents, whether they’re employees, customers or patients. Out-of-state businesses with remote Massachusetts staff are often caught off guard by this.
If you’re a HIPAA-covered healthcare practice, you aren’t exempt. HIPAA compliance helps, but 201 CMR 17.00 has its own requirements and its own definition of personal information. (For more on what a breach can cost a medical practice, see what a HIPAA breach actually costs a small practice.)
Why It Matters
The Massachusetts Attorney General enforces the regulation under the state’s consumer protection law, Chapter 93A, with civil penalties of up to $5,000 per violation. In a breach, every affected record can count as a separate violation, so the numbers climb quickly. The AG has brought actions against small businesses over lost laptops and unencrypted data, not just against large companies.
There’s also a practical reason. When a breach is reported to the Attorney General and the Office of Consumer Affairs and Business Regulation, the notice must say whether your business maintains a WISP. Not having one becomes part of the official record at the worst possible moment. If Social Security numbers are involved, you must also offer affected residents at least 18 months of free credit monitoring.
Beyond the law, a WISP has real business value. Cyber insurance carriers, larger customers and auditors increasingly ask for one, and regulators no longer accept “our IT guy handles it” as an answer. A WISP also forces the questions that prevent breaches in the first place: where your sensitive data lives, who can reach it, and what happens when an employee leaves.
The Path to Compliance, in Brief
Our full guide walks through 11 detailed steps. At a high level, they are:
- Name a responsible person. One employee (or a trusted partner) owns the program.
- Inventory your data. Find every place personal information lives: paper files, laptops, email, cloud apps, payroll and accounting systems.
- Collect less and keep less. Stop gathering what you don’t need, and securely destroy what you no longer have to keep.
- Assess your risks. Identify what could go wrong, both internally and externally, and how likely it is.
- Put safeguards in place. These include multifactor authentication, encryption on laptops and portable devices, access limited to those who need it, current patches, malware protection, and locked file cabinets.
- Train your people. Most incidents start with a human mistake, and phishing aimed at employees keeps rising, so make training regular, not one-time.
- Manage your vendors. Make sure service providers with access to your data are contractually required to protect it.
- Plan for incidents. Know who to call and what to do before something happens.
- Write it down, then review it. Document all of the above in your WISP and revisit it at least once a year, or whenever your business changes.
What a WISP Actually Looks Like
A WISP doesn’t need to be a 100-page binder. For most small businesses it’s a clear, plain-language document of 10 to 20 pages that covers your purpose and scope, the person in charge, the data you hold, your administrative and technical safeguards, your vendors, your incident response plan, and how you monitor and review the program. Employees sign an acknowledgment that they’ve read it.
The most common mistake we see is a WISP that describes safeguards the business doesn’t actually have. A downloaded template with your name pasted in won’t protect you, and it can work against you if your real practices don’t match it. Your WISP has to reflect what you actually do.
Get the Full Guide and Fillable WISP Template
We put together everything a Massachusetts business owner or manager needs to get this done, in one free download:
- The complete 23-page guide (PDF): applicability checks and examples, all 11 steps in detail, a section-by-section walkthrough for building your WISP with sample language, common mistakes, an FAQ, and links to the official Massachusetts resources
- A fillable WISP template (Word): nine core sections with fill-in fields, plus a data inventory, risk assessment worksheet, employee offboarding checklist and employee acknowledgment form
Just fill out a short form and you’ll get instant access, along with a copy sent to your inbox.
The Takeaway
If you hold personal information about even one Massachusetts resident, 201 CMR 17.00 applies to you, regardless of your size or where you’re located. A WISP is a legal requirement, but it’s also one of the most practical security investments a small business can make. It turns good intentions into a clear plan that your team can follow and that regulators, insurers and customers can trust.
Want help building or reviewing your WISP? Cloud9 Tech Solutions works with Massachusetts businesses to put the safeguards in place and document them the right way. Schedule a free security assessment or call us at (508) 978-9225.
This article provides general information and is not legal advice. Consult an attorney about your specific obligations.