Massachusetts WISP Requirements Under 201 CMR 17.00

Massachusetts WISP requirements apply to any business that owns or licenses personal information about a Massachusetts resident, including companies based outside the state and any employer with Massachusetts staff. Under 201 CMR 17.00, in force since March 1, 2010, that business must maintain a written information security program covering specific administrative and technical controls.

The obligation that connects it to your vendors is the one most companies miss: the regulation requires you to oversee service providers by contract. That turns the questions in what to ask your vendors about security from good practice into something Massachusetts law expects you to have done and documented.

Who do Massachusetts WISP requirements apply to?

The regulation applies to every person who owns or licenses personal information about a resident of the Commonwealth. "Person" includes corporations, partnerships, and other legal entities. The trigger is where the data subject lives, not where the business is located.

Personal information, for this purpose, is a Massachusetts resident's first name or first initial and last name combined with a Social Security number, a driver's license or state ID number, or a financial account or card number. Every employer holds that combination for every employee on payroll. So the scope is broader than most companies assume: a firm with no Massachusetts customers but one Massachusetts employee is covered.

Both electronic and paper records are in scope. The full text is on mass.gov.

What must a Massachusetts WISP contain?

Section 17.03 sets the administrative and physical requirements. The program must designate one or more employees to maintain it, identify and assess reasonably foreseeable internal and external risks, set employee security policies with disciplinary measures for violations, and prevent terminated employees from accessing records.

It must also take reasonable steps to select and retain service providers capable of protecting the information and require them by contract to do so, restrict physical access to records, monitor that the program is operating as intended, review it at least annually and whenever business practices change materially, and document responses to any incident.

The regulation scales these obligations to the size, scope, and type of business, the resources available, the amount of data stored, and the need for confidentiality. A ten-person firm and a five-hundred-person firm both need a program. They do not need the same program.

What technical controls does 201 CMR 17.00 require?

Section 17.04 lists computer system requirements, to the extent technically feasible. They include secure user authentication with controlled IDs, secure password practices, protected password storage, and lockout after repeated failed attempts. Access must be restricted to people who need it for their work, and limited to active accounts.

The section also requires encryption of personal information sent across public networks or wirelessly, and encryption of personal information stored on laptops and portable devices. It requires reasonable monitoring for unauthorized use, current firewall protection and security patches, current malware protection, and employee training on the program and on the importance of protecting personal information.

None of that is exotic. It is the baseline covered in five cybersecurity things every business should do first, written into state regulation. The work is in being able to show it is in place.

What does the vendor requirement mean in practice?

Section 17.03 requires taking reasonable steps to select service providers capable of maintaining appropriate security measures, and requiring them by contract to implement and maintain those measures. That reaches every outside party with access to the personal information you hold: payroll, benefits, cloud storage, IT support, email, and anything else in the chain.

In practice that means three things. A list of every provider with access, which is the vendor register described in the sub-processor problem. Contract language that obligates each one to protect the data, which is the subject of flowing down security obligations. And evidence that you checked before signing, which is the purpose of asking vendors about security in the first place.

What does a WISP look like for a thirty-person company?

Shorter than people fear and more specific than most templates. A useful program names the person responsible, lists where personal information actually lives, records who can access each location and why, and states the controls in place for each. It names every service provider with access and points to the contract terms that bind them.

It also describes what happens operationally: how access is granted when someone joins, how it is removed when they leave, how laptops are encrypted, how incidents are reported and reviewed. Section 17.03(2)(j) requires documenting responsive actions taken in connection with any breach, and a mandatory post-incident review of what changed as a result.

The test of a good WISP is whether a new office manager could read it and know what to do. A program that only a consultant can interpret is not operating as intended, which is what the annual review requirement exists to catch.

Why does the WISP matter after a breach?

Because Massachusetts asks about it directly. When a business reports a data breach under Chapter 93H, the notice to the Attorney General must state whether the business maintains a written information security program. That disclosure is covered in Massachusetts data breach notification requirements.

A program written after an incident is not a program that existed before it. The value of the WISP is that it was operating when it mattered.

Where do you start?

The Commonwealth publishes a 201 CMR 17.00 compliance checklist designed to help smaller organizations build a program. Start there, then inventory where personal information actually lives, which is usually more places than anyone expects. Data governance: where to start covers that inventory, and writing a security policy without a security team covers the drafting.

We build systems at Kief Studio in Worcester and Shrewsbury where these controls are properties of the build rather than paperwork added afterward. Brian Gagne leads security architecture, and briansgagne.com goes deeper on the technical controls. MyRHC offers a structured compliance assessment. This is general information, not legal advice.

Related reading

• What to ask your vendors about security
• Massachusetts data breach notification requirements
• Flowing down security obligations to vendors
• The sub-processor problem
• How to write a cybersecurity policy without a security team

Frequently Asked Questions

Who needs a WISP in Massachusetts?

Any person or business that owns or licenses personal information about a Massachusetts resident, including out-of-state companies and any employer with Massachusetts employees. The requirement comes from 201 CMR 17.00.

What counts as personal information under 201 CMR 17.00?

A Massachusetts resident's first name or initial and last name combined with a Social Security number, driver's license or state ID number, or financial account or card number. Employee payroll records almost always qualify.

Does a Massachusetts WISP have to cover vendors?

Yes. The regulation requires reasonable steps to select service providers capable of protecting personal information and requires that they be obligated by contract to implement appropriate security measures.

How often must a WISP be reviewed?

At least annually, and whenever there is a material change in business practices that could affect the security of records containing personal information.

Is there an official template for a Massachusetts WISP?

The Commonwealth publishes a 201 CMR 17.00 compliance checklist intended to help smaller organizations develop a program. The program itself must reflect the specific business, its data, and its risks.