Massachusetts 201 CMR 17.00

Massachusetts Standards for Protection of Personal Information - WISP, encryption, vendor mgmt.


Short name	MA 201 CMR
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MA 201 CMR

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for MA 201 CMR.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for MA 201 CMR and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MA-201-17.03` Written Information Security Program	Every covered entity must develop and maintain a comprehensive, documented written information security program appropriate to its size and the data held, supported by formally identified and timestamped technical documentation of its systems (201 CMR 17.03(1))	Scan
`MA-201-17.03-VENDOR` Third-Party Service Provider Oversight	The WISP must include taking reasonable steps to select and retain service providers capable of maintaining appropriate security measures and requiring such measures by contract, which requires knowing the supplier of each component and service in use (201 CMR 17.03(2)(f))	Scan
`MA-201-17.04-PATCH` Reasonably Up-to-Date System Software	Computer system security requirements include reasonably up-to-date firewall protection and operating system security patches; determining whether software is up to date requires knowing the version of every deployed component (201 CMR 17.04 patching/firewall element)	Scan
`MA-201-17.04-MALW` Current Protective Software Versions	The regulation requires reasonably up-to-date versions of system security agent software, set to receive current updates; this excludes vague or floating version declarations for security-relevant components (201 CMR 17.04 malware-protection element)	Scan
`MA-201-17.04-ENC` Encryption and Integrity of Records	Personal information transmitted across public networks or stored on portable devices must be encrypted, a protection level that presupposes cryptographic integrity controls across the software stack handling those records (201 CMR 17.04 encryption elements)	Scan
`MA-201-17.04-MON` System Monitoring Readiness	The WISP must include reasonable monitoring of systems for unauthorized use of or access to personal information, which requires the monitored systems and their components to be individually identifiable (201 CMR 17.04 monitoring element)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`17.03-WISP`	Written Information Security Program (WISP)
`17.03-RISK`	Risk Assessment & Identification
`17.03-VENDOR`	Vendor Management & Contracts
`17.03-TRAINING`	Employee Security Training
`17.04-NETWORK`	Secure Network Architecture
`17.04-ACCESS`	Access Control & Authentication
`17.04-ENCRYPT-TRANSIT`	Encryption of PI in Transit
`17.04-ENCRYPT-PORTABLE`	Encryption of PI on Portable Devices
`17.04-MONITOR`	Monitoring & Incident Detection
`17.04-DISPOSAL`	Secure Disposal of Records

Policy templates

Written for MA 201 CMR:

Written Information Security Program (WISP)

And 22 from the standard set, adapted to MA 201 CMR.