[Updated October 15, 2009 for compliance with new amendments to the regulations]

by Stephen E. Meltzer, Esq., CIPP

The Comprehensive Written Information Security Program

Any business that owns or licenses personal information must “develop, implement, and maintain a comprehensive information security program” to secure and protect records containing personal information that is written in one or more readily accessible parts (a “CWISP”).

The program must be “consistent with the safeguards for protection of personal information and information of a similar character set forth in any state or federal regulations by which the person who owns or licenses such information may be regulated.”  The program must “contain administrative, technical, and physical safeguards that are appropriate to” (a) the size, scope, and type of the business, (b) the resources available to the business, (c) the amount of stored information, and (d) the need for security and confidentiality of both consumer and employee information. Every program, however, must incorporate at least the following components:

(a)    Designate an employee to maintain the WISP.

(b)    Identify and assess reasonably foreseeable risks (Internal and external).

(c)    Develop security policies for keeping, accessing and transporting records.

(d)    Impose disciplinary measures for violations of the program.

(e)    Prevent access by terminated employees.

(f)    Oversee service providers and contractually ensure compliance.

(g)    Restrict physical access to records.

(h)    Monitor security practices to ensure effectiveness and make changes if warranted.

(i)    Review the program at least annually.

(j)    Document responsive actions to breaches.

Popularity: 100% [?]

Related posts:

1. New Massachusetts Privacy Laws – Who is Regulated [Updated October 15, 2009 for compliance with new amendments to the regulations]...
2. New Massachusetts Privacy Laws – Computer Security [Updated October 15, 2009 for compliance with new amendments to the regulations]...
3. Introduction to the New Massachusetts Privacy Laws [Updated October 15, 2009 for compliance with new amendments to the regulations]...
4. New Massachusetts Privacy Laws – Data Destruction [Updated October 15, 2009 for compliance with new amendments to the regulations]...
5. New Massachusetts Privacy Laws – Breach Notification Requirements [Updated October 15, 2009 for compliance with new amendments to the regulations]...
6. More tweaks to the Massachusetts data privacy regulations on the way Update: More information on the Foley, Hoag site. According to the Hunton...