Massachusetts requires breach notification without unreasonable delay, with no fixed grace period. Here’s what SMBs need in place, including a real WISP, before an incident hits.