201 CMR 17.00 Compliance: An IT Checklist for Massachusetts Businesses

If your company holds personal information about Massachusetts residents, 201 CMR 17.00 compliance is not optional, and it is not just a legal exercise. This checklist is written for owners and office managers at Massachusetts and New Hampshire businesses with 5 to 300 employees. It turns the state’s data security regulation into plain-English IT tasks you can assign, track, and prove you completed.

Who 201 CMR 17.00 Applies To (and What Counts as Personal Information)

201 CMR 17.00 is Massachusetts’ data protection regulation. It applies to any person or business that owns, licenses, stores, or maintains personal information about a Massachusetts resident. The rule follows the resident, not your office address.

That means a Nashua, Salem, or Pelham company with a handful of Massachusetts customers or employees can fall under it. Size does not exempt you, and industry does not either.

Under the regulation, “personal information” means a Massachusetts resident’s first name (or first initial) and last name combined with any one of the following:

• Social Security number
• Driver’s license or state-issued ID number
• Financial account number, or credit or debit card number

Think about where that data actually lives in your business: payroll files, HR records, client intake forms, scanned IDs, billing systems, and the email inbox where someone attached a W-9 three years ago. Compliance starts with knowing where it all sits.

Building and Maintaining a Written Information Security Program (WISP)

The centerpiece of the regulation is the Written Information Security Program, or WISP. It is a documented set of administrative, technical, and physical safeguards that fits the size of your business and the sensitivity of the data you hold.

A WISP is not a template you download and file away. Regulators and insurers look for evidence that it reflects how your company really operates. At a minimum, it should cover:

• A designated owner. One or more employees responsible for the program.
• A data inventory. Which records contain personal information, and where they are kept, on paper and electronically.
• A risk assessment. Reasonably foreseeable internal and external threats, and how well current safeguards address them.
• Employee policies. Rules for storing, accessing, and transporting records, including off-site and remote work.
• Disciplinary measures. Consequences for violating the program.
• Departing employee procedures. Access is cut off promptly, and devices and records are returned.
• Physical safeguards. Locked storage for paper records and controlled access to areas holding sensitive data.

The most common compliance gap we see is not a missing firewall. It is a WISP that was written once, never updated, and no longer matches the systems the company actually uses.

The Required Technical Controls: Your IT Checklist

This is the section your IT team, or your IT partner, owns. The regulation requires a security system covering computers and wireless networks, to the extent technically feasible. Here is each requirement in plain English.

Secure Authentication

• Every user has a unique login. No shared accounts.
• Passwords meet a sensible strength standard and are never stored in plain sight.
• Lost, stolen, or compromised credentials are blocked quickly.
• Multi-factor sign-in is the practical way to make this control hold up in today’s threat environment.

Access Restriction

• Employees can reach only the records they need to do their jobs.
• Accounts lock after repeated failed login attempts.
• Former employees and contractors lose access the same day they leave.

Encryption

• In transit: personal information sent across public networks or wirelessly must be encrypted.
• On laptops and portable devices: any laptop, phone, tablet, or USB drive holding personal information must be encrypted. A lost, unencrypted laptop is one of the most common triggers for a notification event.

Monitoring

• Systems are watched for unauthorized use of or access to personal information.
• Someone reviews the alerts, and there is a record that they did.

Patching and Updates

• Operating systems and software receive security updates on a consistent schedule.
• Firewalls and network equipment are kept current, not left running outdated firmware for years.

Malware Protection

• Every computer touching personal information runs current, reasonably up-to-date protection against viruses and malicious software.
• Protection is monitored centrally, not left to each employee to manage.

Ransomware is the threat that ties many of these controls together. For a deeper look at how an attack unfolds and how businesses stay ahead of it, read our guide on ransomware recovery and prevention in the Merrimack Valley. Reliable backups are the other half of the story, covered in our essential guide to data backup for small businesses.

Employee Training and Third-Party Vendor Oversight

Train Your People

The regulation requires ongoing employee training on the proper use of your security procedures and the importance of protecting personal information. In practice, most incidents start with a person, not a piece of software.

• Train new hires before they get access to sensitive records.
• Refresh everyone at least annually, and after any incident.
• Cover phishing, safe handling of attachments, and what to do when something looks wrong.
• Keep sign-in sheets or completion records. Documentation is your proof.

Phishing deserves special attention because it is the front door for so many breaches. Our post on shielding against phishing scams covers what to teach your team.

Oversee Your Third-Party Service Providers

If a vendor touches personal information on your behalf, such as a payroll processor, billing service, cloud host, or outside IT firm, you are responsible for making sure they protect it. The regulation expects you to do two things:

• Choose carefully. Take reasonable steps to select providers capable of maintaining appropriate safeguards.
• Require it in writing. Contracts should obligate vendors to implement and maintain appropriate security measures for personal information.

Keep a simple vendor list noting who has access to what, and when each contract was last reviewed.

Breach Response and Notification Basics

Your WISP must include a process for responding to incidents, and Massachusetts law sets notification expectations when personal information is compromised. At a high level, a workable response plan answers these questions before a crisis hits:

• Who is in charge when an incident is suspected?
• How do we contain it and preserve evidence?
• Who needs to be notified, including affected residents, the Attorney General’s office, and the Office of Consumer Affairs and Business Regulation?
• Who will speak to customers, insurers, and legal counsel?

The regulation also calls for a post-incident review of what happened and whether your practices need to change. Because notification rules and thresholds are specific and carry real consequences, confirm the details with qualified legal counsel for your situation. Your IT partner’s role is to help you detect, contain, and document the incident quickly.

Annual Review: Keeping Compliance Current

The regulation requires you to review your security measures at least annually, or whenever your business practices change in a way that affects personal information. A new software platform, a new office, a move to remote work, or a new vendor all count.

A practical annual review includes:

• Updating the data inventory and risk assessment
• Confirming encryption is still active on every laptop and portable device
• Auditing user accounts and removing anything stale
• Reviewing vendor access and contracts
• Re-running employee training
• Testing your incident response plan
• Recording the date, findings, and fixes

That last item is what turns good intentions into defensible compliance.

How a Managed IT Provider Keeps 201 CMR 17.00 Compliance Documented and Current

Most small and mid-sized businesses do not fail this regulation through carelessness. They fail it through drift. Staff turn over, devices get replaced, and the WISP sits in a folder while the real environment changes around it.

As the trusted managed IT partner for Massachusetts and New Hampshire businesses, we see the same pattern across professional services, construction, healthcare-adjacent practices, and small-to-mid-sized businesses across other industries. A managed IT relationship closes the gap by making compliance a routine, not a scramble:

• Documented safeguards. Your technical controls are tracked and recorded, so the evidence exists when someone asks for it.
• Ongoing upkeep. Updates, monitoring, and device protection are handled continuously rather than once a year.
• Review support. Annual reviews happen on schedule, with findings written down.
• A single accountable partner. One team that understands your environment, your vendors, and your risk.

If your business operates in the Boston area, the Merrimack Valley, or along the Route 495 corridor, you can see how we support local organizations through our pages for managed IT services in Boston, MA, Lowell, MA, and Methuen, MA. Our statewide overview lives on the managed IT in Massachusetts page.

Talk Through Your 201 CMR 17.00 Compliance Gaps

Not sure where your business stands against this checklist? A short conversation is usually enough to spot the biggest gaps. Reach out whichever way is easiest:

• Call: (603) 681-6130
• Email: info@lgtechmsp.com
• Book a scoping call: a no-pressure conversation about your environment and what compliance would take
• Stop by: walk-ins are welcome at our Pelham office, no appointment needed

LG Tech MSP
2 Beaver Brook Way, Unit C
Pelham, NH 03076
(603) 681-6130 · info@lgtechmsp.com

To learn more about how we support businesses across the region, visit our managed IT in Massachusetts page.

This article is for general educational purposes and is not legal advice. Consult qualified counsel about your specific obligations under 201 CMR 17.00 and Massachusetts breach notification law.

Last updated: October 29, 2026