Privacy Compliance 101: Why Massachusetts Data Security Standards DO Affect You

Regulatory compliance tips on how to meet new data governance regulations that affect your company--failure could mean fines, loss of reputation and other risk management nightmares.

By Cynthia Larose and Elissa Flynn-Poppey
Mon, December 01, 2008

CIO — Beginning May 1, 2009, businesses will need to pay more attention to data governance; a higher standard will go into effect in an effort to protect Massachusetts residents' personal information. Companies will now be required to implement written programs for the protection of personal information. The standards, 201 C.M.R. 17.00, set out in detail the standards to be met by persons or businesses who own, license, store, or maintain personal information about a Massachusetts consumer or employee (the "standards"). Noteworthy in the scope of data standards, the standards apply to paper as well as to electronic records.

What You Need to DO

Implementation and development of a written, comprehensive security program and establishment of a security system covering businesses' computers are at the heart of the standards. The standards provide a detailed list of comprehensive security system and security system requirements.

Comprehensive, Written Information Security Program

Section 17.03 of the standards requires covered entities to "develop, implement, maintain and monitor a comprehensive, written information security program ("program") applicable to any records containing" protected information which is consistent with industry standards. A program must contain "administrative, technical, and physical safeguards to ensure the security and confidentiality" of the records. Additionally, such safeguards must be consistent with the requirements established by any state or federal standards by which a given organization may be regulated.

The standards specify mandatory minimum requirements to every program. Each program shall:

  • Designate one or more employees to maintain the program;
  • Identify and assessing reasonably foreseeable internal and external risks to the security, confidentiality and integrity of the records containing personal information and—evaluating and improving—the effectiveness of the current safeguards for limiting such risks;
  • Develop security policies for employees as to whether and how employees should be allowed to keep, access and transport records containing personal information outside of business premises;
  • Impose disciplinary measures for violation of the program;
  • Prevent terminated employees from accessing records containing personal information by immediately terminating their access to such records;
  • Take reasonable steps to verify that third-party service providers with access to personal information have the capacity to protect such personal information;
  • Limit the amount of personal information collected to that reasonably necessary to accomplish a legitimate purpose for which it is collected; limiting the time such information is retained to that reasonably necessary to accomplish such purpose; and limiting access to such persons who are reasonably required to know such information in order to accomplish such purpose or to comply with state or federal record retention requirements;
  • Identify records and devices used to store personal information, to determine which records contain personal information;
  • Place reasonable restrictions upon physical access to records containing personal information;
  • Monitor regularly to ensure that the program is operating in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal information; and upgrading information safeguards as necessary to limit risks;
  • Review the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security of records containing personal information;
  • Document responsive actions taken in connection with any incident involving a breach of security or integrity of records.

Continue Reading

As you know, everything is mobile, connected, interactive, and immediate. This is exactly why organizations need a highly agile IT infrastructure in order to keep pace with extreme fluctuations in business demand. This book will help you understand why infrastructure convergence has been widely accepted as the optimal approach for simplifying and accelerating your IT to deliver services at the speed of business while also shifting significantly more IT resources from operations to innovation.
For this white paper, IDC performed an in-depth analysis of the business value of VMware View, defined as the expected ROI associated with the use of the solution as a platform for the targeted deployment of a virtual desktop infrastructure.
This paper explains virtualization, its benefits for mid-sized business and how IBM's virtualization strategy can help these companies reduce costs, improve services and simplify management.
Forrester Research makes recommendations on best practices to optimize branch virtualization and consolidation initiatives. See how a "thin" branch architecture, with key servers, services and applications in the data center that relies on a high-performing WAN connection, can offer the greatest efficiencies.
When trying to achieve continuous compliance with internal policies and external regulations, organizations need to replace traditional processes with a new best practice approach and new innovative technology, such as that provided by IBM Tivoli Endpoint Manager.
IBM Tivoli Endpoint Manager helps organizations automatically manage patches for multiple operating systems and applications across hundreds of thousands of endpoints regardless of location, connection type or status.  
Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as support considerations
Many enterprises have discovered that the use of virtualization to support desktop workloads creates a range of significant benefits. These benefits include price efficiencies, improved IT management and greater agility and choice for end users.

This VMware sponsored webcast with IDC will provide both quantitative measurement of the business value -- defined as the expected ROI -- and qualitative analysis associated with the use of VMware View™. IDC will also provide an analysis of the View Composer and ThinApp™ features of VMware View, including the business value of these solutions and an overview of how they work.

Attend this webcast to learn about:
- Challenges and barriers that might impede the adoption of desktop virtualization
- Navigating roadblocks to facilitate a strategic implementation
- Optimizing qualitative and quantitative benefits to IT and your business
Applications are changing - they're increasingly web-oriented, global in nature and run from multiple device types. Additionally, the volume of data is growing exponentially every year. How do you ensure your applications have fast, accurate, up-to-date information in this new world? Modern applications are data-intensive; delivering data the old way using monolithic databases isn't working. What's needed is a modern approach to data. One that scales-out as needed and delivers predictable high performance, but without sacrificing data consistency or integrity.
VMware View™ 5 simplifies IT management while increasing end user freedom by delivering desktop services from your cloud. Building upon VMware's leadership in desktop virtualization, VMware View 5 delivers a high-performance user experience while giving IT greater policy control.

View this webcast and find out how VMware View 5 can help you:
- Deliver the highest fidelity experience of desktop services across any device and any network
- Simplify and automate IT management, security and control of desktop services
- Reduce the costs associated with your desktop environment
IT professionals are being asked to deliver faster "time-to-value" than ever before. An IDG Research survey found that CIOs are eager to invest in technologies that will enable them to get new applications and services up quickly, achieving faster time-to-value.
Learn how to reduce IT management overhead, ease revision control, guarantee data security, scale systems more quickly and reduce server and software costs.
Newsletter Sign-Up »

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all Newsletters | Privacy Policy
Resource Center