Massachusetts WISP: 201 CMR 17.00 Requirements, Safeguards, and Penalties

If your business holds a Massachusetts resident’s personal information, Massachusetts WISP requirements under 201 CMR 17.00 obligate you to maintain a Written Information Security Program with specific administrative, physical, and technical safeguards. The rule applies no matter where your business is located or how small it is, and the Attorney General can seek civil penalties of up to $5,000 per violation under the state’s consumer protection statute.¹

Who Has to Have a WISP

The regulation reaches every person or entity that owns or licenses personal information about a Massachusetts resident.² “Owns or licenses” is broad on purpose. It covers anyone who collects, stores, or has the contractual right to use the data. A company headquartered in another state that keeps a database with Massachusetts residents in it is covered. A sole proprietor is covered on the same terms as a Fortune 500 company. There is no size exemption.

What the rule does allow is proportionality. The safeguards you adopt have to fit the size and scope of your business, the resources available to you, the amount of data you store, and how sensitive it is.³ A ten-person accounting firm is not expected to run the same infrastructure as a hospital system. Both still need a documented program with real safeguards behind it.

What Data Triggers the Requirement

The WISP obligation kicks in when you hold a Massachusetts resident’s first name (or first initial) and last name combined with any one of the following:⁴

Social Security number
Driver’s license number or state-issued ID number
Financial account number, or credit or debit card number, with or without any associated security code, PIN, or password, if the combination would permit access to the resident’s financial account

The financial account element is often misread. You do not need a security code paired with the account number for the data to qualify. If the account number by itself would grant access to the account, that alone brings the record into scope.⁴

Information lawfully obtained from public records or government sources available to the general public is not personal information under the rule.⁴

What the Written Program Must Contain

Section 17.03 sets the core of the program. The WISP has to be a written document, or a set of them, that is readily accessible to the people responsible for carrying it out. Chapter 93H reinforces the point by requiring every entity holding personal information to develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards.⁵

At a minimum, the program has to include each of the following elements:³

At least one designated employee responsible for maintaining the program.
A risk assessment that identifies foreseeable internal and external risks to the security and integrity of records containing personal information. The assessment has to cover employee training, compliance with existing policies, and the ability to detect and respond to security system failures.
Policies for how employees store, access, and transport records containing personal information outside the office.
Disciplinary measures for employees who violate the program.
Measures that prevent terminated employees from accessing records containing personal information.
Oversight of third-party service providers, including reasonable steps to select vendors capable of protecting the data and contract terms requiring them to maintain appropriate safeguards.
Physical access restrictions, with records stored in locked facilities, rooms, or containers and reasonable limits on who can get to them.
Regular monitoring to verify the program is working and to upgrade safeguards when necessary.
A review of the program’s scope at least once per year, or whenever a material change in business practices could affect the security of personal information.
Documented post-breach review of responsive actions, with a mandatory evaluation of whether business practices need to change.

The risk assessment drives everything else in the program. It is not a one-time checklist. You need to evaluate where personal information lives (paper files, databases, email inboxes, backup drives), who has access to it, and what could go wrong both internally and externally. For a smaller business, even a structured spreadsheet that catalogs each risk and maps it to a specific safeguard can satisfy the requirement.

Technical Safeguards for Electronic Records

If you store or transmit personal information electronically, Section 17.04 adds computer system security requirements. They are mandatory to the extent they are technically feasible.⁶

Authentication and Access Controls

Your systems must use secure authentication protocols. That means control of user IDs, a reasonably secure method for assigning passwords (or an alternative technology such as biometrics or token devices), and safeguards so passwords are not stored in a way that compromises the data they protect. Access must be restricted to active users, and systems have to lock out a user after multiple failed login attempts.

Separate access controls must limit who can view records containing personal information to employees who need it for their job. Every user needs a unique ID and password, and those cannot be the default credentials the vendor shipped. Leaving a default admin password on a network appliance or database is the kind of lapse that can be treated as a compliance failure.

Encryption

All personal information transmitted over public networks or wirelessly must be encrypted. The same applies to personal information stored on laptops and other portable devices.⁶ The regulation does not name a specific standard.

Firewalls, Patching, and Monitoring

Any internet-connected system containing personal information must have reasonably current firewall protection and operating system security patches. You also need current security software with malware protection and virus definitions set to update regularly. Beyond those defensive tools, the rule requires reasonable monitoring of systems for unauthorized use or access. In practice, that means log reviews, intrusion detection, alerting, or some comparable mechanism to spot suspicious activity.

Employee Training

Section 17.04 separately requires education and training for employees on proper use of the computer security system and the importance of protecting personal information. The administrative safeguards in Section 17.03 already require ongoing employee training, so a regular training schedule that covers both obligations is the practical way to handle it.

Remote Work and Portable Devices

The off-premises data policy and portable device encryption requirements carry extra weight when employees work from home. Your WISP should address the specific risks of residential environments: keeping household members away from work devices, enforcing session timeouts and screen locks, requiring encryption on home Wi-Fi, and setting rules for how employees store and dispose of paper records at home. It should also cover incident response in remote settings, including instructions to disconnect a compromised device from the internet while preserving evidence and to notify the security coordinator immediately.

If an employee working remotely has a laptop with unencrypted personal information stolen from a car, the business faces both a breach notification obligation and potential enforcement for failing to encrypt the device as Section 17.04 requires.

What Happens After a Breach

A WISP is designed to prevent breaches, but it also has to account for one. Under Chapter 93H, any entity that knows or has reason to know of a breach of security, or that personal information was acquired or used by an unauthorized person, must provide notice as soon as practicable and without unreasonable delay to three parties: the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and the affected residents.⁷ You also have to notify consumer reporting agencies and any state agencies identified by the Director of Consumer Affairs.

The Attorney General’s office accepts breach notifications through an online portal. The disclosures required include the nature of the breach, the number of Massachusetts residents affected, the types of personal information compromised, whether you maintain a WISP, the steps you have taken or plan to take in response, and whether law enforcement has been contacted.⁸ You cannot delay the initial notice because you have not yet calculated the full number of affected residents. You send what you know and update it as you learn more.⁷

This is where the post-breach review piece of Section 17.03 earns its keep. The regulation requires you to document what happened, what you did, and what has to change going forward.³ When the Attorney General reviews your notification, one of the first questions is whether you had a WISP and what it said.

Penalties for Noncompliance

The Attorney General enforces 201 CMR 17.00 through Chapter 93A, the state’s consumer protection statute. Chapter 93H expressly authorizes the Attorney General to bring an action under Chapter 93A Section 4 to remedy violations.⁹

If a court finds that a person used a method or practice they knew or should have known violated the consumer protection statute, it can impose a civil penalty of up to $5,000 per violation. Violating the terms of an injunction issued under Section 4 carries a penalty of up to $10,000 per violation.¹ Because each affected record can be a separate violation, a single breach involving thousands of residents can generate enormous aggregate exposure. The breach notification form specifically asks whether you maintained a WISP, and the absence of one is close to an admission of noncompliance.

Overlap With Federal Rules

Satisfying 201 CMR 17.00 does not automatically satisfy federal data security laws, and the reverse is also true. Two federal regimes overlap most often.

If your business handles protected health information, you have to comply with both HIPAA and 201 CMR 17.00. HIPAA generally preempts state law, but Massachusetts provisions that are “more stringent” than HIPAA (meaning they give greater privacy protection or greater individual rights) survive preemption.¹⁰ Massachusetts’ encryption mandates for portable devices and its breach notification requirements often exceed the HIPAA baseline, so healthcare entities typically have to meet both.

Non-banking financial institutions, including mortgage brokers, tax preparers, collection agencies, and investment advisors not registered with the SEC, must also comply with the FTC Safeguards Rule under 16 CFR Part 314.¹¹ The federal rule requires its own written program with elements such as a designated qualified individual, a written risk assessment, multi-factor authentication, annual penetration testing, and a written incident response plan. Several of those are more specific than what 201 CMR 17.00 demands. If both apply to you, building one program that meets the stricter requirement for each element is the efficient path.

1
General Court of Massachusetts. Massachusetts General Laws Chapter 93A Section 4
2
Legal Information Institute. 201 CMR 17.01 – Purpose and Scope
3
Legal Information Institute. 201 CMR 17.03 – Duty to Protect and Standards for Protecting Personal Information
4
Legal Information Institute. 201 CMR 17.02 – Definitions
5
General Court of Massachusetts. Massachusetts General Laws Chapter 93H – Security Breaches
6
Legal Information Institute. 201 CMR 17.04 – Computer System Security Requirements
7
General Court of Massachusetts. Massachusetts General Laws Chapter 93H Section 3
8
Mass.gov. Reporting Data Breaches to the Attorney General’s Office
9
General Court of Massachusetts. Massachusetts General Laws Chapter 93H Section 6
10
U.S. Department of Health & Human Services. How Do I Know If a State Law Is More Stringent Than the HIPAA Privacy Rule
11
eCFR. Standards for Safeguarding Customer Information