Here’s a requirement that surprises many Massachusetts business owners: if you hold personal information about even one Massachusetts resident, employee or customer, state law requires you to have a Written Information Security Program, or WISP. It’s not optional, it’s not just for big companies, and “we have good IT” doesn’t satisfy it. The good news is that a WISP is very achievable. Here’s what it is and how to get one in place.
What a WISP Is
A WISP is a written document that describes how your business protects personal information, the administrative, technical, and physical safeguards you have in place. Massachusetts regulation 201 CMR 17.00 requires any business that owns or licenses personal information about a Massachusetts resident to develop, implement, and maintain one. Personal information here means a resident’s name combined with a Social Security number, driver’s license number, or financial account number, exactly the kind of data almost every business holds about its employees.
Why It Matters Beyond Compliance
A WISP does three things at once. It keeps you compliant with state law (and aligns with HIPAA, FTC Safeguards, and other frameworks). It’s increasingly requested during cyber insurance applications and client security questionnaires, having one ready can win business and lower premiums. And the process of writing it forces you to actually find the gaps in how you handle sensitive data, which is valuable regardless of the paperwork.
What Goes Into a WISP
A compliant WISP generally covers:
A designated person responsible for the program. An inventory of what personal information you collect, where it lives, and who can access it. Risk assessment, identifying reasonably foreseeable threats. Safeguards, the technical controls like encryption, access controls, MFA, and secure disposal, plus physical controls like locked storage. Employee training on the policies. Vendor oversight, ensuring third parties who touch your data protect it too. And incident response and review, what you do if there’s a breach, and a commitment to keep the program current.
The Specific Technical Requirements
201 CMR 17.00 calls out concrete measures, including encryption of personal information transmitted over public networks and stored on laptops and portable devices, secure user authentication and access controls, up-to-date security software and patching, and monitoring. These aren’t vague aspirations, they’re the same cybersecurity controls that protect you from breaches in the first place. A WISP is partly a document and partly proof that these controls exist.
A Document Backed by Reality
The biggest mistake businesses make is downloading a WISP template, filling in their name, and filing it away, while the actual safeguards it claims don’t exist. If you ever have an incident, regulators and insurers will check whether the program was real. The WISP and the IT reality behind it have to match. That’s why building one works best alongside a compliance and IT partner who can implement the controls, not just write about them.
Get Your WISP Done Right
A WISP is a legal requirement, a sales asset, and a security health check rolled into one, and most Massachusetts businesses either don’t have one or have one that doesn’t reflect reality. Boston Networks helps clients build a genuine WISP and put the safeguards behind it in place. Request a consultation and we’ll get you compliant and genuinely more secure.