Any business, wherever it is based, that holds a Massachusetts resident's name with a Social Security, driver's licence or card number must run a written information security programme, and many fail because the document exists but the controls behind it do not. 201 CMR 17.00, Standards for the Protection of Personal Information of Residents of the Commonwealth, has applied since 1 March 2010 and requires a written information security programme (WISP) with specific technical controls such as encryption on laptops and over public networks. Its breach notification statute asks every breached organisation whether it maintains a WISP, so the question reaches the Attorney General with each notification. This guide goes clause by clause through what the regulation requires, how the Attorney General enforces it and how to build and evidence a WISP that holds up. It is for CISOs, compliance leads, IT managers at small and mid-sized firms and auditors. Status: summarised from the regulation and the Massachusetts General Laws as published by the Commonwealth, checked 27 October 2026.
Key takeaways
- Residence of the data subject decides scope. The regulation applies to every person that owns or licenses personal information about a Massachusetts resident, so out-of-state employers and retailers with Massachusetts customers or staff are covered.
- The WISP has ten mandatory elements. 201 CMR 17.03(2) lists them, from a named owner and risk assessment through service provider oversight, annual review and post-incident review.
- Eight computer controls are specified. 17.04 requires, to the extent technically feasible, secure authentication, access control, encryption in transit over public networks and wireless, monitoring, encryption on laptops and portable devices, firewalls and patching, anti-malware and training.
- Scale is allowed, absence is not. Safeguards must be appropriate to size, scope and type of business, resources, data volume and confidentiality needs, but every element must be present.
- Enforcement runs through consumer protection law. The Attorney General can sue under M.G.L. c. 93A section 4, where civil penalties reach $5,000 per violation plus investigation costs and attorneys' fees.
Scope: who and what is covered
201 CMR 17.00 implements M.G.L. chapter 93H and sets minimum standards for safeguarding personal information in both paper and electronic records. It is narrower in data and wider in reach than most privacy laws. For other states' rules see the US State Cybersecurity Laws Map.
| Term (17.02) | Meaning (paraphrased) | Practical reading |
|---|---|---|
| Personal information | A Massachusetts resident's first name and last name, or first initial and last name, with a Social Security number; a driver's licence or state ID number; or a financial account, credit or debit card number (with or without a code that would permit access). Lawfully obtained publicly available information is excluded | HR, payroll, benefits, customer billing and card data sets are the usual holdings |
| Owns or licenses | Receives, stores, maintains, processes or otherwise has access to personal information in connection with providing goods or services or with employment | Holding staff records is enough; you do not need to sell anything to residents |
| Service provider | Any person that receives, stores, maintains, processes or otherwise is permitted access to personal information through providing services directly to a covered person | Payroll processors, cloud and SaaS providers, MSPs, shredding firms |
| Encrypted | Transformation of data so that its meaning cannot be determined without a confidential process or key | Use current, recognised algorithms and protect the keys separately from the data |
Because the trigger is data about a resident, a firm with no office in Massachusetts but one remote employee there is covered for that employee's records. Organisations already regulated under federal rules, such as the GLBA Safeguards Rule, still need to check the Massachusetts specifics, notably the encryption requirements. See the GLBA Safeguards Rule Guide.
Key obligations
The written programme (17.03)
17.03(1) requires a comprehensive information security written programme that contains administrative, technical and physical safeguards appropriate to "size, scope and type of business", "the amount of resources available", "the amount of stored data" and "the need for security and confidentiality of both consumer and employee information". 17.03(2) then sets ten required elements.
| Element | Requirement (paraphrased) | Evidence an assessor will ask for |
|---|---|---|
| 17.03(2)(a) | Designate one or more employees to maintain the programme | Named owner in the WISP, role description |
| 17.03(2)(b) | Identify and assess reasonably foreseeable internal and external risks and evaluate and improve safeguards, including ongoing employee (including temporary and contract employee) training, compliance with policies and means for detecting and preventing security system failures | Risk assessment, training records, control monitoring |
| 17.03(2)(c) | Policies on whether and how employees keep, access and transport records off business premises | Remote working and removable media policy |
| 17.03(2)(d) | Disciplinary measures for violations | HR policy reference |
| 17.03(2)(e) | Prevent terminated employees from accessing records | Leaver process and timings, access removal evidence |
| 17.03(2)(f) | Take reasonable steps to select service providers capable of appropriate security and require them by contract to implement and maintain it | Due diligence files, contract clauses |
| 17.03(2)(g) | Reasonable restrictions on physical access, with records stored in locked facilities, storage areas or containers | Physical security standard, site checks |
| 17.03(2)(h) | Regular monitoring to ensure the programme operates as intended and upgrading safeguards as necessary | Monitoring reports, metrics |
| 17.03(2)(i) | Review the scope of security measures at least annually or whenever there is a material change in business practices | Dated annual review minutes |
| 17.03(2)(j) | Document responsive actions after any incident and conduct a mandatory post-incident review | Incident log and lessons learned reports |
Computer system security requirements (17.04)
Every covered person that electronically stores or transmits personal information must include, as part of the WISP, a security system with the following elements "to the extent technically feasible":
- Secure user authentication (17.04(1)): control of user IDs and other identifiers; a reasonably secure method of assigning and selecting passwords or use of unique identifier technologies such as biometrics or tokens; control of passwords so they are kept in a location or format that does not compromise the data they protect; access restricted to active users and active accounts; and blocking access after multiple unsuccessful attempts.
- Secure access control (17.04(2)): access to records limited to those who need it for their job, and unique identification plus passwords that are not vendor-supplied defaults for each person with access.
- Encryption in transit (17.04(3)): encryption of "all transmitted records and files containing personal information that will travel across public networks", and of "all data containing personal information to be transmitted wirelessly".
- Monitoring (17.04(4)): reasonable monitoring of systems for unauthorised use of or access to personal information.
- Encryption at rest on portable devices (17.04(5)): encryption of personal information on laptops and other portable devices.
- Firewalls and patches (17.04(6)): reasonably up-to-date firewall protection and operating system security patches for internet-connected systems holding personal information.
- Security software (17.04(7)): reasonably up-to-date system security agent software including malware protection, with current patches and virus definitions, or a supported version that can still be updated.
- Education and training (17.04(8)): employees trained on proper use of the computer security system and the importance of personal information security.
Mapping the clauses to modern controls
| 201 CMR 17 clause | Modern implementation | NIST SP 800-53 Rev 5 | CIS Controls v8.1 |
|---|---|---|---|
| 17.04(1) authentication | SSO with phishing-resistant MFA, account lockout, password storage in a vault | IA-2, IA-5, AC-7 | Control 5, Control 6 |
| 17.04(2) access control | Role-based access, unique accounts, no shared or default credentials | AC-2, AC-6 | Control 6 |
| 17.04(3) encryption in transit | TLS 1.2 or later for web, mail and APIs; WPA3 or WPA2-Enterprise for wireless | SC-8 | Control 3 |
| 17.04(4) monitoring | Central logging and alerting on access to HR and customer data stores | SI-4, AU-6 | Control 8 |
| 17.04(5) portable encryption | Full-disk encryption on laptops, MDM-enforced encryption on mobiles, encrypted removable media | SC-28 | Control 3 |
| 17.04(6) firewalls and patches | Host and network firewalls, patching SLAs | SC-7, SI-2 | Control 4, Control 7 |
| 17.04(7) security software | EDR or anti-malware with current definitions | SI-3 | Control 10 |
| 17.04(8) training | Annual and onboarding training with data handling content | AT-2 | Control 14 |
Timeline and current status
| Date | Event |
|---|---|
| 1 March 2010 | Full compliance with 201 CMR 17.00 required (17.05) |
| 1 March 2012 | End of the transition that let service provider contracts signed before 1 March 2010 stand without the security clause (17.03(2)(f)) |
| 19 October 2017 | Regulation date shown on the Commonwealth's regulation page |
| 27 October 2026 | Status check for this guide: regulation in force; M.G.L. c. 93H section 3 breach notices to the Attorney General ask whether the organisation maintains a WISP |
The Commonwealth's web page notes that its online text is an unofficial version, so cite the official regulation in formal compliance documents. The control list has not been updated for cloud, MFA or zero trust, which is why the mapping table above matters: assessors read "reasonably secure" and "reasonably up-to-date" against current practice, not 2010 practice.
Enforcement and penalties
- Who enforces: under M.G.L. c. 93H section 6, the Attorney General may bring an action under section 4 of chapter 93A against a person that violates the chapter, and may seek other remedies.
- Civil penalties: chapter 93A section 4 allows a civil penalty of not more than $5,000 for each violation where the person knew or should have known the conduct was unlawful, plus the reasonable costs of investigation and litigation, including attorneys' fees, and injunctions. Violating an injunction or court order can carry up to $10,000 per violation.
- How cases start: mostly through breach notifications. Section 3 of chapter 93H requires notice to the Attorney General and the Director of Consumer Affairs and Business Regulation "as soon as practicable and without unreasonable delay", including the nature of the breach, the number of residents affected, the types of data and "whether the person or agency maintains a written information security program". A "no" invites scrutiny.
- Service providers: a person that maintains or stores data it does not own must notify the owner or licensor and cooperate with it.
Because penalties are per violation, a breach affecting many residents can create large exposure, and the WISP question gives the Attorney General an immediate measure of whether the organisation met its baseline duty. For how Massachusetts notification sits beside other regimes see the Breach Notification Laws by Country Guide.
What it means for AI agents and non-human identities
- "User IDs and other identifiers" include service accounts: 17.04(1) and (2) ask for control of identifiers, unique identification and no vendor default passwords. Apply that to service accounts, API keys and integration users that read HR or customer systems, not only to staff. See the Service Account Security Guide.
- Password storage applies to secrets: the requirement that passwords be kept in a location or format that does not compromise the data they protect is directly relevant to hard-coded credentials and API keys in scripts and repositories. Move them into a secrets manager. See the Secrets Management Guide.
- Active accounts only: dormant integrations and orphaned automation accounts with access to payroll or card data breach the "active users and active user accounts only" requirement in spirit. Include non-human identities in leaver and review processes.
- AI tools are service providers: an AI assistant or SaaS agent that processes employee or customer personal information is a service provider under 17.02. 17.03(2)(f) requires due diligence and a contractual security commitment.
- Monitoring should cover machine access: 17.04(4) monitoring for unauthorised access should alert on unusual bulk reads by service accounts and agents as well as by people.
Compliance steps
- Find the data: inventory systems and paper records holding Massachusetts residents' names with SSNs, licence or ID numbers, or financial account and card numbers, including exports and backups.
- Name the owner: appoint the WISP owner under 17.03(2)(a) and set the governance route for decisions and exceptions.
- Assess risk: run and document a risk assessment covering internal and external threats, training, compliance and failure detection.
- Write the WISP: one document or a set of readily accessible parts covering all ten 17.03(2) elements and all eight 17.04 controls, scaled to your size, with references to the implementing standards.
- Close technical gaps first where data is exposed: laptop and mobile encryption, encryption in transit, MFA, removal of default and shared credentials, patching and EDR.
- Fix service provider contracts: add security obligations and due diligence evidence for every provider with access to personal information, including AI and SaaS tools.
- Test and evidence: check leaver access removal, lockout settings and encryption status with reports, and keep them.
- Review annually and after change: date and minute the 17.03(2)(i) review; repeat after acquisitions, new systems or major incidents.
- Link to incident response: make sure the incident plan documents actions and a post-incident review under 17.03(2)(j), and the notification process under c. 93H section 3. See the Incident Response Plan Template.
Small business versus large enterprise
| Aspect | Small business | Large enterprise |
|---|---|---|
| WISP format | A single document of a few pages naming the owner and each control | A policy plus standards and procedures, mapped to 201 CMR 17 in a control matrix |
| Risk assessment | Annual workshop and short register | Formal enterprise risk process with data owners |
| Monitoring | Built-in logs and alerts from SaaS and endpoint tools | SIEM with use cases for personal information stores |
| Service providers | Checklist and standard contract clause | Third-party risk programme with tiering |
Measuring it
- Encryption coverage: percentage of laptops and mobiles with verified encryption; target 100%.
- Leaver speed: median time from termination to access removal, for people and for owned service accounts.
- Default and shared credentials: count found in scans; target zero.
- Provider coverage: percentage of providers handling personal information with a security clause and due diligence on file.
- Review currency: days since the last documented annual WISP review.
Common failure patterns
- A WISP downloaded and never implemented: the template names controls the organisation does not run, which is worse evidence than a short accurate document.
- Unencrypted laptops and exports: a lost laptop or an emailed spreadsheet of payroll data is exactly the exposure 17.04(3) and (5) target.
- Paper forgotten: HR files and printed reports are in scope and need locked storage under 17.03(2)(g).
- No contractual clause for SaaS: providers onboarded by business teams without the 17.03(2)(f) security commitment.
- Service accounts outside the rules: integration accounts with shared passwords that never expire, contrary to the identifier and password controls.
- No annual review evidence: the review happens informally, so there is nothing to show the Attorney General after a breach.
Practitioner checklist
- All stores of Massachusetts residents' personal information, paper and electronic, are inventoried.
- The WISP names an owner and covers all ten 17.03(2) elements and all eight 17.04 controls.
- A documented risk assessment is updated at least annually.
- Laptops and portable devices are encrypted, and data over public networks and wireless is encrypted.
- Authentication includes unique IDs, lockout, no default passwords and secure storage of credentials and secrets.
- Service accounts and AI integrations are inventoried, owned and included in reviews and leaver processes.
- Every service provider with access has due diligence and a contractual security clause.
- Monitoring alerts on unauthorised and bulk access to personal information.
- Incident response documents actions, a post-incident review and c. 93H notification.
- The annual WISP review is dated and minuted.
Standards and references
- Commonwealth of Massachusetts: 201 CMR 17.00 Standards for the Protection of Personal Information of Residents of the Commonwealth
- Commonwealth of Massachusetts: 201 CMR 17.00 regulation page
- General Court of Massachusetts: M.G.L. c. 93H section 3, Duty to report known security breach
- General Court of Massachusetts: M.G.L. c. 93H section 6, Enforcement
- General Court of Massachusetts: M.G.L. c. 93A section 4, Actions by the attorney general
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
Related NHI Mgmt Group resources: US State Cybersecurity Laws Map · GLBA Safeguards Rule Guide · State Cybersecurity Safe Harbour Laws Guide · NYDFS Part 500 Guide. This guide summarises Massachusetts 201 CMR 17.00 and M.G.L. chapter 93H and is not legal advice.