Massachusetts. Cybersecurity. Regulation
201 CMR 17.00Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00)
Partly verified
Medium confidence.dpo_required Conditional: designate employees to maintain WISP. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires anyone owning or licensing personal information of Massachusetts residents to maintain a written information security programme with specified controls, including encryption of personal information on laptops and in transit over public networks.
- Key themes
- Unique features
One of the earliest prescriptive state security rules; applies regardless of where the business is located.
- SaaS relevance
SaaS holding Massachusetts residents' SSNs, financial account or ID numbers needs a WISP and must be overseen by customers as a service provider.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See M.G.L. c. 93H (separate statute)
- DPO
- Conditional
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per violation (M.G.L. c. 93A)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text mass.gov
- Authority
- Massachusetts Attorney General; Office of Consumer Affairs and Business Regulation
§5Where it applies
- Domestic law of
- Massachusetts
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Conditional: designate employees to maintain WISP. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.