201 CMR 17.00

201 CMR 17.00 is the Massachusetts data security regulation, in force since 2010. It was one of the first state rules to require a written information security program, and it still reads like a practical checklist: named responsibilities, risk assessment, training, vendor oversight and specific computer security controls.

It protects the personal information of Massachusetts residents, so it applies to organizations anywhere that hold that information, including employers with Massachusetts staff.

• Any person who owns or licenses personal information about a Massachusetts resident, in paper or electronic form. It covers businesses of all sizes; the program must be appropriate to size, resources, the amount of data and the need for security.
• Personal information is a resident's first name or initial and last name combined with a Social Security number, a driver's license or state ID number, or a financial account or credit or debit card number.
• It works alongside the Massachusetts breach notice law (M.G.L. c. 93H), which requires notice to the Attorney General and the Office of Consumer Affairs and Business Regulation as well as to residents.

The Attorney General enforces under M.G.L. c. 93H and the consumer protection statute, c. 93A, which allows civil penalties per violation, injunctive relief and costs. Settlements after breaches commonly cite the absence of a written program, encryption or vendor oversight.

1. Write the program down and name the employee or employees who maintain it.
2. Assess risks to records containing personal information, including paper.
3. Encrypt personal information on laptops and portable devices, and when sent over public networks or wirelessly.
4. Contract with vendors to require appropriate safeguards, and check that they meet them.
5. Cut off access promptly when employees leave.
6. Review the program at least annually, and after any incident.