Massachusetts Security Law (WISP)

Effective March 1st, 2010 there is a new security law that will go into effect. It applies to anyone possessing personal information about a Massachusetts resident. As quoted from the regulation itself, it "establishes minimum standards to be met in connection with the safeguarding of personal information contained in both paper and electronic records".

It requires that such individuals/business entities develop, implement, and maintain a comprehensive information security program that is written.

This law includes the following definition of personal information: a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements

1. Social Security number; that relate to such resident:
   
2. driver's license number or state-issued identification card number; or
   
3. financial account number, or credit or debit card number, with or without any required security code,

For guidance on preparing a policy, please reference the links below:

• Link to the actual regulations
  
• Compliance checklist
  
• Sample "Written Information Security Plan"