Your Timeline for Compliance with MGL 93H 201CMR17.00

October 2009

Designate an Information Security Officer - You will need to designate at least 1 person at your place of business who will maintain the comprehensive information security program. Finding that person now will help get the rest of the items in line for when they need to be done. You can get a compliance checklist at: 201 CMR 17.00 Compliance Checklist

November

Start Assessing Your Information:

• Identify the paper, electronic and other type records, including storage media, laptops and portable devices that contain personal information.**
• Check all anti-virus and security patches on all computer systems and servers -- make sure they are up to date.**
• Check that you have reasonably up-to-date versions of
  system security agent software (including malware
  protection)**
• Identify what "personal information" moves around your business and out of your office including:**
  1. healthcare/insurance information
  2. benefits/401K information
  3. Accounting/Tax information
  4. Employment and Credit Applications
  5. Checks and credit card information
• Identify persons who need to see the "personal information" and those who do not.
• Identify where encryption for personal information is needed.**
• Identify what third-party service providers your business may use that have access to personal information
• Identify reasonably foreseeable internal and external risks to paper and electronic records containing personal information.**
• Identify any systems that are connected to the internet and make sure the firewall protection for files containing personal information are up-to-date.**

December 2009

• Purchase any hardware or software upgrades that are needed**
• Get control of user IDS and other identifiers**
• Come up with a reasonably secure method of assigning/selecting passwords for users**
• Start developing your WISP (Written Information Security Program)
• Make sure that your WISP is applicable to all records containing personal information about a resident of the Commonwealth of Massachusetts

Make sure that you include:

• Administrative, technical and physical safeguards for Personal information protection
• Any identified and reasonably foreseeable internal and external risks to paper and electronic records
• Regular and ongoing employee training, and procedures for monitoring employee compliance
• Disciplinary measures for violators
• Policies and procedures for when and how records containing personal information should be kept, accessed or transported off your business premises
• Processes for blocking terminated employees physical and electronic access to personal information, including deactivating their passwords and user names
• Steps taken to verify third party service providers access
• The length of time that you are storing records containing personal information.
• Specifically the manner in which physical access to personal information records is to be restricted
• Whether you are storing your records and data in locked facilities, storage areas or containers and the security measures taken to keep these areas secure
• Actions and documenting that is taken in connection with any breach of security

January 2010

• Install all hardware and software upgrades**
• Test policies that have been written
• Start Training Employees on new policies
• Finalize WISP
• Finish Training Employees
• Send out WISP Policy to all Employees and get signatures from all that they understand and will comply

February 2010 and beyond

• Continue monitoring your systems and procedures**
• Continue providing training to new and existing employees
• Update policies as required
• Assure all computers and servers remain up-to-date with patches and anti-virus software**

** NSK Inc. can help you with any of these tasks, just let us know.