What does 201 CMR 17.00 require of a Massachusetts business? 201 CMR 17.00 requires any business that holds personal information about a Massachusetts resident to keep a written information security program, often called a WISP, and to follow it. The program must name who is responsible, assess risk, control access, oversee vendors, and include specific technical controls such as encryption on laptops. It applies to companies of every size, including ones whose only personal data is their own payroll.
The regulation has been in force since March 2010. Many owner-operators have heard of it. Fewer could hand over their written program today, and fewer still could say when it was last reviewed. This guide covers what the rule asks for, in plain terms, so you can tell whether you are in good shape.
Who 201 CMR 17.00 covers
The regulation applies to "all persons that own or license personal information about a resident of the Commonwealth" (Mass.gov). Two definitions decide whether that includes you.
Personal information is a resident's first name or first initial and last name, combined with any one of:
- a Social Security number
- a driver's license or state ID number
- a financial account number, or a credit or debit card number
Owns or licenses is broader than it sounds. It covers anyone who receives, stores, maintains, processes, or otherwise has access to that information in connection with providing goods or services, or in connection with employment.
That last phrase matters. If you employ people in Massachusetts and keep their Social Security numbers for payroll and tax forms, you are covered. You do not need customer data for the rule to apply. There is also no size exemption. A twelve-person firm in Woburn and a three-hundred-person manufacturer in Worcester carry the same obligation.
What the regulation does allow is proportion. The safeguards must be appropriate to the size, scope, and type of the business, the resources available, the amount of data stored, and the need to protect both consumer and employee information. A small firm is not expected to run a large firm's program. It is expected to have one.
The ten elements of a written information security program
Section 17.03 lists what the written program must include. In plain language:
- A named owner. One or more employees designated to maintain the program.
- A risk assessment. Identify reasonably foreseeable internal and external risks, then evaluate and improve your safeguards, including training, policy compliance, and how you detect failures.
- Rules for records outside the office. How personal information is stored, accessed, and carried off premises, including laptops and paper.
- Discipline. Consequences for violating the program.
- Offboarding. Terminated employees lose access to personal information promptly.
- Vendor oversight. Choose service providers capable of protecting the data, and require them by contract to do so.
- Physical security. Reasonable restrictions on physical access, with records kept in locked areas or containers.
- Monitoring. Regular checks that the program works, and upgrades when it does not.
- An annual review. At least once a year, and whenever a material change in business practices affects how personal information is handled.
- Incident documentation. A record of actions taken after any breach, and a review of what should change afterward.
The regulation also says the program must be "written in one or more readily accessible parts." A set of policies that lives only in one person's head does not meet the standard.
The eight technical controls in 17.04
If you store or transmit personal information electronically, which nearly every business does, Section 17.04 adds a security system covering your computers and wireless network. To the extent technically feasible, it must include:
| Control | What it means in practice |
|---|---|
| Secure authentication | Unique user IDs, sound password practices, protected password storage, and lockout after repeated failed attempts |
| Access controls | People reach only the records their job needs, with no shared or vendor-default passwords |
| Encryption in transit | Personal information sent across public networks or over wireless is encrypted |
| Monitoring | Reasonable monitoring for unauthorized access or use |
| Encryption on portable devices | Personal information on laptops and other portable devices is encrypted |
| Firewalls and patching | Current firewall protection and operating system patches on internet-connected systems |
| Malware protection | Current security software with up-to-date definitions |
| Training | Employees are educated on security and on protecting personal information |
None of these are exotic. Most are the same controls cyber insurance carriers now ask about at renewal, which is one reason the two conversations belong together. We cover the carrier side in cyber insurance requirements.
Where owner-operated companies usually fall short
The gaps are rarely the technology. More often they are the parts that need an owner's attention.
- No named owner. The WISP was drafted years ago, often by an outside provider, and nobody inside the company is responsible for it now.
- Vendor contracts are silent. Payroll, benefits, bookkeeping, and IT providers all touch personal information. Few contracts say anything about how they protect it.
- Offboarding is informal. Accounts stay active after someone leaves because no one owns the checklist.
- The annual review never happens. The program describes systems the company no longer uses.
- New tools are not in scope. AI assistants and file-sharing apps receive employee or customer data without anyone deciding whether they should. A short written policy helps here, and our free AI policy starter is a quick way to draft one.
A short checklist for this quarter
- Find your current WISP. If there isn't one, start one.
- Name the person who owns it, in writing.
- List every system and vendor that holds Social Security, license, or account numbers.
- Confirm laptops are encrypted and that multi-factor sign-in is on for email and remote access.
- Check that your payroll, benefits, and IT contracts include security obligations.
- Put the annual review on the calendar.
Massachusetts also has separate breach notification duties that apply if personal information is exposed. Your incident section should say who makes that call and who your counsel is. This article is a plain-language summary, not legal advice, and a business in a regulated industry should confirm its obligations with counsel.
Where The Deady Group fits
We do not write policies for sale or resell security products. We help Massachusetts companies see where they stand and decide what to fix first, and we disclose how we are compensated before any recommendation. If you are weighing outside help for this work, our guide to choosing an IT consulting firm in Boston covers what to ask. For an outside view of your environment, start with the free Digital Presence & Technology Review.
Questions, answered plainly
Does 201 CMR 17.00 apply to a small business? Yes, if it owns or licenses personal information about a Massachusetts resident, which includes employee records kept for payroll. There is no size exemption. The regulation does allow the safeguards to be scaled to the size of the business, its resources, and the amount of data it holds.
Does a business outside Massachusetts have to comply? The regulation applies to all persons that own or license personal information about a resident of the Commonwealth. It is written around the resident, not the location of the business, so a company elsewhere with Massachusetts customers or employees should treat it as applying.
Can we use a WISP template? A template is a reasonable starting point for structure. It only becomes your program when it names your people, your systems, your vendors, and the risks you actually face, and when you do what it says. An unedited template describes a company that does not exist.
How often does the program have to be reviewed? At least once a year, and whenever there is a material change in business practices that could affect the security of personal information, such as a new system, an acquisition, or a move to remote work.
