The Massachusetts Data Security Law Most Business Owners Don't Know About
Here's a question that makes most Massachusetts business owners uncomfortable: do you have a Written Information Security Program? If you collect personal information from Massachusetts residents — names, Social Security numbers, driver's license numbers, financial account numbers — state law requires you to have one. It's called a WISP, and it's been the law since 2010 under 201 CMR 17.00.
Yet the majority of small businesses across Plymouth, the South Shore, and throughout Massachusetts don't have one. And the penalties for non-compliance can be severe.
What Exactly Is a WISP?
A WISP (Written Information Security Program) is a documented set of policies and procedures that describes how your business protects personal information. It's not just an IT document — it covers administrative, technical, and physical safeguards for any personal data you collect, store, or transmit.
Think of it as your business's security playbook. It tells your employees what to do with sensitive data, how your technology protects it, and what happens when something goes wrong.
Does Your South Shore Business Need a WISP?
Yes, if you meet ANY of these criteria:
- You have employees (you collect their Social Security numbers for payroll)
- You accept credit card payments (you handle financial account numbers)
- You maintain customer records with personal information
- You're a healthcare provider (patient data includes personal information)
- You're a law firm, accounting firm, or financial advisor (client data)
- You run a dental practice, medical office, or pharmacy
In short: virtually every business in Plymouth, Brockton, Quincy, and the South Shore needs a WISP. If you have even one employee or one customer whose personal data you store, you need one.
What Must a WISP Include?
Massachusetts 201 CMR 17.00 specifies minimum requirements. Your WISP must address:
1. Designated Security Coordinator
Someone in your organization must be responsible for maintaining and enforcing the WISP. For small businesses on the South Shore, this is often the owner or office manager. You can also designate an external IT partner like Power Up Boston to serve in this role.
2. Risk Assessment
Identify where personal information exists in your business — paper files, computers, email, cloud services, third-party vendors. Evaluate the risks to each and document your findings. A dental office in Duxbury has different risks than a manufacturing plant in Brockton, but both need this assessment.
3. Employee Training
All employees who handle personal information must be trained on your security policies. This isn't a one-time orientation item — training should be ongoing with documentation of who was trained and when.
4. Access Controls
Limit access to personal information to only those employees who need it for their job. This means: - Unique user accounts for every employee (no shared logins) - Strong password policies - Physical access controls for rooms where records are stored - Termination procedures that immediately revoke access when someone leaves
5. Encryption Requirements
Personal information must be encrypted: - On laptops and portable devices - When transmitted over the internet or wireless networks - On any device that leaves the business premises
This catches many South Shore businesses off guard. If your employees email spreadsheets with customer data or carry laptops with unencrypted drives, you're out of compliance.
6. Monitoring and Logging
Your systems must be monitored for unauthorized access. This includes: - Firewall monitoring and logging - Antivirus and anti-malware protection - Detection of unauthorized access attempts - Regular review of security logs
7. Third-Party Service Provider Oversight
If you use a payroll company, cloud storage, IT provider, or any third party that accesses personal information, your WISP must address how you ensure they protect that data. You need contracts that require your vendors to maintain appropriate security measures.
8. Incident Response Procedures
What happens when a breach occurs? Your WISP must include: - How to identify and contain a breach - Who to notify internally - Massachusetts breach notification requirements (notify the AG and affected individuals) - Documentation and remediation procedures
9. Physical Security
Not everything is digital. Your WISP must address: - Locked filing cabinets for paper records - Clean desk policies - Secure disposal of documents (shredding) - Visitor access procedures - Security camera systems for areas where records are stored
10. Regular Review and Updates
Your WISP isn't a set-it-and-forget-it document. It must be reviewed at least annually and updated whenever there are material changes to your business, technology, or the threat landscape.
Penalties for Not Having a WISP in Massachusetts
The Massachusetts Attorney General enforces 201 CMR 17.00. Penalties include:
- Fines up to $5,000 per violation under the Consumer Protection Act (MGL Chapter 93A)
- Lawsuits from affected individuals whose data was compromised
- Regulatory investigations that consume time and money
- Reputational damage that can devastate a local business
In 2024, the AG's office increased enforcement actions against businesses without WISPs, particularly after data breaches. A South Shore business that suffers a breach without a WISP in place faces significantly harsher consequences than one with a documented program.
How to Create a WISP for Your South Shore Business
Step 1: Inventory Your Personal Information
Map every place personal information exists in your business: - Employee HR files (paper and digital) - Customer databases and CRM systems - Email accounts - Accounting and payroll systems - Point-of-sale systems - Paper files and filing cabinets - Backup tapes or drives - Third-party cloud services
Step 2: Assess Your Current Security
Compare your current practices against the 201 CMR 17.00 requirements. Common gaps we find in South Shore businesses include: - No encryption on laptops - Shared user accounts - No formal employee training program - No incident response plan - No oversight of third-party vendors
Step 3: Write Your Policies
Document your security policies covering every requirement. Use clear, specific language. "We use strong passwords" isn't sufficient. "All passwords must be at least 12 characters, include upper and lowercase letters, numbers, and symbols, and be changed every 90 days" meets the standard.
Step 4: Implement Technical Controls
Deploy the technology to enforce your policies: - Endpoint encryption (BitLocker, FileVault) - Multi-factor authentication - Managed firewall with logging - Antivirus/anti-malware on all endpoints - Secure email gateway - Backup and disaster recovery - Network monitoring
Step 5: Train Your Team
Conduct security awareness training for all employees. Cover: - What personal information is and how to identify it - Your WISP policies and their responsibilities - Phishing awareness and social engineering - Proper data handling and disposal - Incident reporting procedures
Step 6: Review Annually
Schedule an annual WISP review. Document the review, any changes made, and the rationale. Keep records of all reviews for at least 7 years.
WISP vs. Other Compliance Requirements
Your WISP may overlap with other compliance frameworks:
- HIPAA — healthcare providers need both a WISP and HIPAA compliance
- PCI DSS — businesses accepting credit cards need PCI compliance in addition to a WISP
- CMMC — defense contractors need CMMC certification plus a WISP for any Massachusetts personal data
- SOC 2 — technology companies may need SOC 2 in addition to a WISP
A well-designed cybersecurity program can address multiple compliance requirements simultaneously, saving you time and money.
Get Your WISP Done Right
Power Up Boston helps businesses across Plymouth, the South Shore, and Southeastern Massachusetts create, implement, and maintain their Written Information Security Programs. We handle the technical assessment, policy writing, employee training, and ongoing compliance monitoring so you can focus on running your business.
Contact us today for a free WISP compliance consultation. We'll assess your current posture and give you a clear roadmap to compliance. Don't wait for a data breach to find out you're not protected.