Do You Need a WISP in Massachusetts? 201 CMR 17.00 Guide

The short answer

If your business owns or licenses personal information about a Massachusetts resident, Massachusetts regulation 201 CMR 17.00 may apply to you — and a comprehensive, written information security program is one of its central requirements. That can include a business outside Massachusetts if it owns or licenses covered personal information about a Massachusetts resident.

The part that surprises owners is how specific the definition of “personal information” is. Under the regulation, it generally means a Massachusetts resident’s first name or initial and last name combined with one or more of the following:

• Social Security number
• Driver’s license or state-issued identification number
• Financial account, credit card, or debit card number — with or without a security code, access code, PIN, or password that would permit access

There are important details and exceptions in the regulation, so this article is practical guidance, not legal advice. But if your files, email, systems, paper records, or service providers handle that kind of information, do not assume being small exempts you. Size does not matter when it comes to data compliance.

What is a WISP?

WISP stands for Written Information Security Program.

I have met business owners who hear “WISP” and assume it means buying a template, changing the company name at the top, and saving the PDF in a folder. I have also met owners and managers who acquire an outline, create their own, and check everything off without verifying whether it is true — just to say they completed it. That gives you a document. It does not necessarily give you a security program.

A real WISP should describe how your business protects covered information through administrative, technical, and physical safeguards. It should reflect your actual people, systems, information, vendors, risks, and procedures.

The Massachusetts regulation is designed to be risk-based. Honestly, it is a very low bar to ask for personal data to be secured. Safeguards should be appropriate to the size, scope, and type of business; the resources available; the amount of data involved; and the need for security and confidentiality.

In plain language: a three-person office and a 300-person organization may not need identical programs, but “we are small” is not a substitute for having one. A WISP should be considered an entry-level security standard to implement in any business, regardless of industry or data practices.

Why I care about the difference between paper and protection

When I work with a business on compliance, I try to separate two things: what does the document say, and what is actually true in the environment?

• A WISP might say the company reviews user access regularly. Does it?
• It might say employees use unique accounts. Are administrator passwords still shared?
• It might say backups are maintained. Has anyone tested a recovery?
• It might say vendors are reviewed. Can anyone list which vendors have access to personal information?
• It might say terminated employees are removed promptly. Is there an actual offboarding process?

This is why one of our compliance guardrails is:

Never sell paperwork as protection.

Documentation matters. It creates accountability, consistency, and evidence. But the paper and the technology have to be congruent.

What should a Massachusetts WISP address?

The exact program should be tailored to the organization, but common elements include:

A designated responsible person

Someone needs responsibility for maintaining the program. That does not mean the person performs every technical task, but ownership cannot be vague. If you have a dedicated IT partner or person, this is usually their responsibility.

An inventory and risk assessment

The business should understand what covered information it has, where it is stored, how it moves, who can access it, and what reasonably foreseeable risks could affect it. Data can be identified as PHI, PII, HIPAA-covered, and more — it depends on what you are storing, and depending on your industry is when compliance gets stricter.

Employee policies and training

The program should address employee access, acceptable use, passwords, reporting suspicious activity, and handling paper and electronic records — and what happens when someone joins, changes roles, or leaves. Onboarding and offboarding policies and procedures are common practice.

Access controls

Access should be limited to people who need it. Shared administrator accounts, old accounts, unnecessary permissions, and unmanaged third-party access create avoidable risk. If you are not using role-based access control (RBAC) throughout the company, you are already at risk.

Authentication and passwords

The regulation includes requirements around secure authentication protocols and access control. In current practice, multifactor authentication should be a baseline for important systems, even when another rule is not explicitly forcing the issue. A password manager alongside enforced MFA is what we usually recommend.

Encryption

The regulation addresses encryption of personal information transmitted across public networks or wirelessly, and of covered information stored on portable devices where technically feasible. This is mostly done for you — but if no one is helping you manage your environment or has rules for sensitive data, there might be a gap somewhere. Encrypted email is common to have, but rarely used correctly when no policy is in place.

Monitoring, updates, and protection

Systems processing personal information should have reasonably up-to-date security protections, operating-system patches, and appropriate monitoring.

Vendor oversight

If another company handles personal information for you, that relationship belongs in the security program. Contracts, access, security expectations, and ongoing suitability all matter.

Incident response

The business should know what to do when information may have been lost, exposed, or accessed without authorization. Massachusetts also has breach-notification requirements that may apply. Having an Incident Response Plan (IRP) is also required for compliance-based industries.

Review and improvement

A WISP is not a one-time school assignment. It should be reviewed when the business, technology, people, risks, or regulatory requirements change — and at least on a regular schedule. We recommend at least once a year, or as needed by industry standards.

Businesses that should pay close attention

201 CMR 17.00 is not limited to a single industry. Examples of businesses that may own or license covered personal information include:

• Accounting and tax practices
• Payroll and bookkeeping companies
• Financial and insurance businesses
• Law firms
• Healthcare organizations and qualifying service providers
• Auto dealers and businesses arranging financing
• Employers maintaining employee records
• Property management companies
• Professional offices collecting identity or payment information
• Technology providers handling client information

Coverage depends on the information and circumstances, not simply the label on the company. Some industries also have additional requirements.

For example, the IRS says tax and accounting professionals are treated as financial institutions under the federal Gramm-Leach-Bliley Act Safeguards Rule, regardless of size, and are required to implement and maintain a WISP. The FTC’s Safeguards Rule has its own detailed requirements for covered financial institutions.

Compliance with one framework does not always eliminate obligations under another. The Massachusetts 201 CMR 17.00 FAQ specifically explains that owning or licensing Massachusetts residents’ personal information can create obligations even where a business already complies with HIPAA.

A quick self-check

Ask these questions:

1. 01Do we have covered personal information about Massachusetts residents?
2. 02Can we identify where it is stored — paper, email, cloud platforms, devices, and backups?
3. 03Do we have a written program tailored to our business?
4. 04Does the program name the responsible person?
5. 05Do our real technical controls match the document?
6. 06Are employees trained on the parts that apply to them?
7. 07Do we review who has access?
8. 08Do we know which vendors handle the information?
9. 09Do we have an incident-response and notification process?
10. 10When was the program last reviewed and materially updated?

If several answers are “I think so,” that is a useful signal. Compliance should not depend on assumptions.

What Truly Unlimited does — and what we do not claim

TU Compliance helps businesses assess gaps, organize their security program, prepare and maintain documentation, implement technical controls, improve identity and device security, manage evidence, train staff, and review the environment over time.

We do not issue legal opinions, guarantee that an organization can never experience an incident, or sell a document as automatic certification. Where legal interpretation is required, we encourage the business to involve qualified counsel. Our role is to help make the written program and the operating environment real, supportable, and aligned.

Start with truth

The best WISP does not begin with a template. It begins with the truth about your business: what information do you have? Who can reach it? Which systems and vendors touch it? What protections are actually working? What would your team do if something went wrong?

Once those answers are clear, the document becomes more useful — because it describes a real program, not an imaginary one.