What Is a WISP and Does Your MA Business Need One?

The Law Most Massachusetts Business Owners Don't Know About

Here's a question that stops most business owners in their tracks: Did you know that Massachusetts law requires your business to have a Written Information Security Program?

It's called a WISP, and it's been required since 2010 under 201 CMR 17.00 — the Massachusetts Standards for the Protection of Personal Information. Yet the vast majority of small businesses we talk to on the South Shore have never heard of it, let alone created one.

What Exactly Is a WISP?

A WISP is a documented set of policies and procedures that describes how your business protects the personal information of Massachusetts residents. It covers everything from who has access to sensitive data, to how you dispose of old hard drives, to what you do if there's a breach.

Think of it as your business's security playbook. It's not just a document you write and file away — it's meant to be a living guide that your team follows every day.

Who Needs a WISP?

The short answer: almost certainly you.

If your business owns, licenses, stores, or maintains personal information of Massachusetts residents, you need a WISP. "Personal information" under MA law means a resident's first name (or initial) and last name in combination with any of:

Social Security number
Driver's license number
State-issued ID number
Financial account number (bank account, credit card, debit card)

Do you have employees in Massachusetts? You have their Social Security numbers for payroll. You need a WISP.

Do you have customers whose credit card information you process? You need a WISP.

Do you collect any combination of names and the data listed above? You need a WISP.

This applies to businesses of every size — from solo practitioners to large corporations. There is no small business exemption.

What Must a WISP Include?

Massachusetts 201 CMR 17.00 spells out specific requirements. Your WISP must address:

Designated Security Coordinator: Someone in your organization must be responsible for maintaining and enforcing the WISP. For small businesses, this is often the owner.

Risk Assessment: You must identify and evaluate internal and external risks to the security of personal information. This isn't a one-time thing — it needs to be ongoing.

Employee Training: All employees with access to personal information must receive training on your security policies and procedures. Document when training occurs.

Access Controls: Restrict access to personal data to only those employees who need it to do their jobs. No one else should be able to see it.

Encryption: All personal information transmitted across public networks (including email) or stored on portable devices (laptops, USB drives) must be encrypted.

Terminated Employee Procedures: When someone leaves, immediately revoke all access to systems, building, email, and data. Don't wait — do it on their last day.

Computer Security: Maintain reasonably up-to-date firewall protection, operating system security patches, antivirus software, and secure authentication protocols.

Monitoring: Regularly monitor for unauthorized access to or use of personal information.

Incident Response: Have a documented plan for responding to security breaches, including notification procedures required under MA breach notification law.

Third-Party Service Providers: Require any service providers who access personal information to maintain appropriate security measures. Get it in writing.

What Happens If You Don't Have One?

The Massachusetts Attorney General can bring enforcement action under Chapter 93A (the consumer protection act), with penalties of up to $5,000 per violation. If you have 100 customer records and each one is a violation, the math gets ugly fast.

But the real risk isn't the fine — it's what happens if you have a data breach without a WISP. You'll face:

Mandatory breach notification costs (letters to every affected person)
Credit monitoring for affected individuals (often 1-2 years)
Potential lawsuits from affected individuals
Regulatory investigation
Reputation damage

Having a WISP won't prevent every breach, but it demonstrates that you took reasonable steps to protect data — which significantly reduces your legal exposure.

How to Create a WISP for Your Business

You have two options:

Option 1: DIY. You can create a WISP yourself using templates and guides. The MA Office of Consumer Affairs has published guidance documents. However, the technical requirements (encryption, firewall configuration, access controls) usually require IT expertise to implement properly.

Option 2: Work with an IT provider. This is what we recommend for most businesses. A qualified IT provider can assess your current security posture, identify gaps, create a customized WISP, and implement the technical controls it documents — all in one engagement.

The key word is "customized." Generic templates are a starting point, but your WISP needs to reflect how your specific business actually handles data. An assessor or regulator can tell the difference between a WISP you actually follow and one you downloaded and filed away.

Common WISP Mistakes We See

After helping dozens of South Shore businesses create WISPs, here are the most common issues:

Using a generic template without customization. Your WISP needs to describe your actual systems, processes, and personnel.

Writing it and forgetting it. A WISP must be reviewed and updated at least annually. Set a calendar reminder.

No employee training documentation. You need to prove that employees were trained. Keep sign-off sheets or training completion records.

No encryption on laptops. If any employee takes a laptop home with personal data on it, full-disk encryption is required. Period.

No terminated employee checklist. Create a documented offboarding process and follow it every time.

Take Action Today

Don't wait for a breach or an enforcement action to take this seriously. Creating a WISP is manageable, especially with the right help.

Power Up Boston helps Massachusetts businesses create customized WISPs that meet 201 CMR 17.00 requirements. We also implement the technical controls your WISP documents, from encryption and cybersecurity to backup and disaster recovery.