Meet 201 CMR 17.00 and build your WISP with less effort

201 CMR 17.00 is the Massachusetts regulation that sets minimum standards for protecting personal information about Massachusetts residents. Issued by the Office of Consumer Affairs and Business Regulation under Chapter 93H of the Massachusetts General Laws, it requires a written information security program with administrative, technical and physical safeguards, plus specific computer security controls such as authentication, access control, encryption and monitoring.

Any person or organisation that owns or licenses personal information about a Massachusetts resident must comply, wherever it is based. Personal information means a name combined with a Social Security number, driver's licence or state ID number, or a financial account or payment card number. That includes data held about employees, so most businesses with Massachusetts staff or customers are in scope.

A WISP is the written information security program that Section 17.03 requires. It must be documented in one or more readily accessible parts and scaled to the size of the business, its resources, the amount of data it holds and the need to protect customer and employee information. It must name responsible staff, assess risks, cover training, discipline, offboarding, service providers, physical access, monitoring, annual review and incident documentation.

The Massachusetts Attorney General enforces Chapter 93H, and the data security rules behind 201 CMR 17.00, through the state consumer protection law, Chapter 93A. Under Section 4 of Chapter 93A, a court can order civil penalties of up to $5,000 for each violation, together with injunctions and the costs of investigation and litigation. The Attorney General has used consent judgments to settle data security cases.

Yes, in specific cases. Section 17.04 requires encryption, where technically feasible, of personal information sent across public networks, all personal information transmitted wirelessly, and all personal information stored on laptops or other portable devices. It does not set a blanket requirement to encrypt every system at rest, but encryption is the expected safeguard for these higher-risk situations.

201 CMR 17.00 is a legal requirement, while ISO 27001 and SOC 2 are voluntary frameworks. There is strong overlap: risk assessment, access control, encryption, monitoring, supplier management, training and incident response all appear in each. An ISO 27001 information security management system or SOC 2 programme can support a WISP, but you should still confirm every specific Massachusetts element, such as encryption of portable devices, is documented.

It depends on your size, how much personal information you hold and what security controls already exist. The regulation itself is short, with two operative sections, so a business with existing security policies may mainly need to write or update its WISP and close specific gaps. Organisations starting from nothing will need longer to put technical controls and supplier contracts in place.

201 CMR 17.00 is mapped in OneClickComply's control library and is available on request. Because its controls map to frameworks such as ISO 27001 and SOC 2, evidence and policies you already manage in OneClickComply can count towards the Massachusetts requirements. Contact the team to enable it for your account and discuss your scope with our in-house audit team.