A Cygnus Business Services brand[ Service area · Northern Massachusetts ]
Cybersecurity for northern Massachusetts businesses
Lowell, Lawrence, Haverhill, Andover, Newburyport, and the rest of the Merrimack Valley and North Shore. Massachusetts has some of the most specific data security rules in the country. Here is what they ask and how we help.
[ State law ]
What Massachusetts asks of you
// 01
201 CMR 17.00 and the WISP
Anyone who holds a Massachusetts resident’s name with a Social Security number, driver’s license or state ID number, or financial account or card number must keep a written information security program. That includes out-of-state businesses with Massachusetts employees or customers.
// 02
Required technical controls
The rule names specific controls: secure logins, access limited to people who need it, encryption of personal information on laptops and portable devices and when sent over public networks or Wi-Fi, current firewall and malware protection, monitoring, and training.
// 03
Breach notice (M.G.L. c. 93H)
After a breach you notify the Attorney General, the Office of Consumer Affairs and Business Regulation, and affected residents as soon as practicable and without unreasonable delay. If Social Security numbers were exposed, you must offer at least 18 months of free credit monitoring.
This is a plain-English summary. Your attorney has the final word on how a law applies to your business.
[ Who we work with ]
Northern Massachusetts businesses we see most
// 01
Merrimack Valley manufacturers
Many shops in the Lowell, Lawrence, and Haverhill area supply defense primes. CMMC requirements are now showing up in those contracts. We start with a gap assessment against NIST SP 800-171.
// 02
Financial and professional offices
Advisors, accountants, and law firms on the North Shore hold exactly the data 201 CMR 17.00 covers. We write the WISP and set up encryption, access controls, and training to match it.
// 03
Healthcare practices
HIPAA and the WISP rule overlap. One risk assessment can cover both, so you are not paying twice for the same work.
// 04
New Hampshire businesses with Massachusetts staff
If you are across the border in Salem or Seabrook with employees who live in Massachusetts, this rule applies to you too. See New Hampshire.
[ FAQ ]
Massachusetts questions
We are based in New Hampshire but have a few Massachusetts employees. Does the WISP rule apply?
Very likely, yes. 201 CMR 17.00 applies to anyone who owns or licenses personal information about a Massachusetts resident, and payroll records include Social Security numbers. Where your office sits does not change that.
What goes into a WISP?
A named person responsible for the program, a risk assessment, policies for who can access personal information, employee training, oversight of vendors who handle the data, secure logins, encryption on laptops and for data sent over public networks, current firewall and malware protection, and at least a yearly review.
Can you write our WISP?
Yes. We write it with you so it describes what your business actually does, then help you put the technical controls in place so the document is true.
[ Next step ]
Get your WISP in order
Start with a free consultation. Onboarding is free for plan clients.