SlideShare a Scribd company logo
1 of 60
The Massachusetts Data Privacy Rules Stephen E. Meltzer, Esquire, CIPP
The New Massachusetts Data Security Rules
 
New Mandate: PI = PI Personal Information = Privacy Infrastructure
 
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
What Prompted the Rules? ,[object Object],[object Object],[object Object],[object Object]
Looking Ahead ,[object Object],[object Object],[object Object],[object Object],[object Object]
Scope of Rules
Scope of Rules ,[object Object],[object Object],[object Object]
Scope of Rules ,[object Object],[object Object],[object Object],[object Object],[object Object]
Scope of Rules ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Three Requirements ,[object Object],[object Object],[object Object],[object Object]
Evaluating Compliance ( not  Evaluating Applicability ) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Evaluating Compliance ( not  Evaluating Applicability ) ,[object Object]
Enforcement ,[object Object],[object Object],[object Object],[object Object]
Comprehensive Written Information Security Program 201 CMR 17.03
Information Security Program ,[object Object]
Comprehensive Information Security Program   201 CMR 17.03 (2)(a) through (j) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object]
Breach Reporting G.L. c. 93H  §  3
Breach Reporting ,[object Object],[object Object]
Breach Reporting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Breach Reporting ,[object Object],[object Object],[object Object],[object Object]
Sample Breach Notification Letter ,[object Object]
Breach Reporting ,[object Object],[object Object],[object Object]
Computer System Security Requirements 201 CMR 17.04
Electronic Requirements 201 CMR 17.04 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
User Authentication Protocols ,[object Object],[object Object],[object Object],[object Object],Examples:  Passwords should be at least 9 characters, alpha numeric with special characters After 3 attempts to login users are blocked access
Secure Access Control Measures ,[object Object],[object Object],Example:  Network Access Control Software/Hardware  Consentry Sophos Audit control who is accessing what and when?
Encryption of Transmitted Records ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Examples: PGP and Utimaco are encryption technologies
Monitoring of Systems ,[object Object],[object Object],Examples: Again, Network Access Control Audit controls
Laptop and Mobile Device Encryption ,[object Object],[object Object],[object Object],[object Object],This applies only if you have data in motion of personal information. Email is clear text.  So anyone can read any ones email on the internet.
Security Patches and Firewalls ,[object Object],[object Object],All organizations should have a firewall in place (not a router a firewall) Can hire an organization to update and manage the security infrastructure: Firewall Anti-virus Patches…
Systems Security Agent Software ,[object Object],[object Object],[object Object],[object Object],Malware is what is infecting most enviroments.  HTTP and HTTPS traffic. Your users are your worst enemy Products to look at for Malware TrendMicro Websense Webwasher
Employee Education and IT Security Training ,[object Object],[object Object],[object Object],[object Object],[object Object],Your employees are your weakest link to any IT security program. They need to know the rules. Suggestions: Stand up training News Letters Programs Online training
The Approach ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Security is all about vigilance… Compliance is knowing what you need to protect and building a fortress around it and testing it on a frequent basis!
Data Destruction G.L. c. 93I
Data Destruction (93I) ,[object Object],[object Object],[object Object]
Data Destruction (93I) ,[object Object],[object Object],[object Object]
What To Do Now
Compliance Deadlines March 1, 2010 ,[object Object],[object Object],[object Object],[object Object],[object Object]
Tasks
Tasks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Tasks ,[object Object],[object Object],[object Object],[object Object]
Tasks ,[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Resources ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Good News ,[object Object],[object Object],[object Object]
Thank You

More Related Content

What's hot

3.6 legislation and regulations
3.6 legislation and regulations3.6 legislation and regulations
3.6 legislation and regulations
mrmwood
 
IS4799 Final Project (1)
IS4799 Final Project (1)IS4799 Final Project (1)
IS4799 Final Project (1)
Mark Milburn
 
Cyber security guide
Cyber security guideCyber security guide
Cyber security guide
Mark Bennett
 
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
Michael Noel
 

What's hot (19)

Information Security Management
Information Security ManagementInformation Security Management
Information Security Management
 
3.6 legislation and regulations
3.6 legislation and regulations3.6 legislation and regulations
3.6 legislation and regulations
 
A Brave New World of Cyber Security and Data Breach
A Brave New World of Cyber Security and Data BreachA Brave New World of Cyber Security and Data Breach
A Brave New World of Cyber Security and Data Breach
 
IS4799 Final Project (1)
IS4799 Final Project (1)IS4799 Final Project (1)
IS4799 Final Project (1)
 
Cybersecurity Update
Cybersecurity UpdateCybersecurity Update
Cybersecurity Update
 
Cyber security guide
Cyber security guideCyber security guide
Cyber security guide
 
Effective cybersecurity for small and midsize businesses
Effective cybersecurity for small and midsize businessesEffective cybersecurity for small and midsize businesses
Effective cybersecurity for small and midsize businesses
 
Improve Cybersecurity Education Or Awareness Training
Improve Cybersecurity Education Or Awareness TrainingImprove Cybersecurity Education Or Awareness Training
Improve Cybersecurity Education Or Awareness Training
 
Information Security vs IT - Key Roles & Responsibilities
Information Security vs IT - Key Roles & ResponsibilitiesInformation Security vs IT - Key Roles & Responsibilities
Information Security vs IT - Key Roles & Responsibilities
 
Information security
Information securityInformation security
Information security
 
Information security.pptx
Information security.pptxInformation security.pptx
Information security.pptx
 
Managing System Security
Managing System SecurityManaging System Security
Managing System Security
 
Understanding Identity Management and Security.
Understanding Identity Management and Security.Understanding Identity Management and Security.
Understanding Identity Management and Security.
 
Cyber Risk Quantification for Employees | Safe Security
Cyber Risk Quantification for Employees | Safe SecurityCyber Risk Quantification for Employees | Safe Security
Cyber Risk Quantification for Employees | Safe Security
 
Computing safety
Computing safetyComputing safety
Computing safety
 
Tripwire Energy Working Group Session w/Dale Peterson
Tripwire Energy Working Group Session w/Dale PetersonTripwire Energy Working Group Session w/Dale Peterson
Tripwire Energy Working Group Session w/Dale Peterson
 
The Accidental Insider Threat
The Accidental Insider ThreatThe Accidental Insider Threat
The Accidental Insider Threat
 
Topic11
Topic11Topic11
Topic11
 
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
You are Doing IT Security Wrong - Understanding the Threat of Modern Cyber-at...
 

Viewers also liked

MKTGMAL076-Driving-innovation-in-government
MKTGMAL076-Driving-innovation-in-governmentMKTGMAL076-Driving-innovation-in-government
MKTGMAL076-Driving-innovation-in-government
bharatchoragudi
 
Impact_Report_Congressional_Award
Impact_Report_Congressional_AwardImpact_Report_Congressional_Award
Impact_Report_Congressional_Award
Lauren Neubauer
 
AA Associates Company Profile.DOC
AA  Associates Company Profile.DOCAA  Associates Company Profile.DOC
AA Associates Company Profile.DOC
MUHAMMAD AFTAB ALAM
 
Chitta_Jyothi_Swaroop
Chitta_Jyothi_SwaroopChitta_Jyothi_Swaroop
Chitta_Jyothi_Swaroop
CJ SWARUP
 
5 tipus de receptors gps
5 tipus de receptors gps5 tipus de receptors gps
5 tipus de receptors gps
xgoterris
 
10 google earth
10 google earth10 google earth
10 google earth
xgoterris
 

Viewers also liked (16)

MKTGMAL076-Driving-innovation-in-government
MKTGMAL076-Driving-innovation-in-governmentMKTGMAL076-Driving-innovation-in-government
MKTGMAL076-Driving-innovation-in-government
 
Impact_Report_Congressional_Award
Impact_Report_Congressional_AwardImpact_Report_Congressional_Award
Impact_Report_Congressional_Award
 
AA Associates Company Profile.DOC
AA  Associates Company Profile.DOCAA  Associates Company Profile.DOC
AA Associates Company Profile.DOC
 
Chitta_Jyothi_Swaroop
Chitta_Jyothi_SwaroopChitta_Jyothi_Swaroop
Chitta_Jyothi_Swaroop
 
Midterm ppp
Midterm pppMidterm ppp
Midterm ppp
 
Squline Mandarin Business Intermediate 2 Lesson 34
Squline Mandarin Business Intermediate 2 Lesson 34Squline Mandarin Business Intermediate 2 Lesson 34
Squline Mandarin Business Intermediate 2 Lesson 34
 
9 wikiloc
9 wikiloc9 wikiloc
9 wikiloc
 
Crimeandpunishmentintro
CrimeandpunishmentintroCrimeandpunishmentintro
Crimeandpunishmentintro
 
certificate (1)
certificate (1)certificate (1)
certificate (1)
 
Habits by Design
Habits by DesignHabits by Design
Habits by Design
 
5 tipus de receptors gps
5 tipus de receptors gps5 tipus de receptors gps
5 tipus de receptors gps
 
Europe continent
Europe continentEurope continent
Europe continent
 
10 google earth
10 google earth10 google earth
10 google earth
 
ETIQUETA SECRETARIAL
ETIQUETA SECRETARIALETIQUETA SECRETARIAL
ETIQUETA SECRETARIAL
 
Gps sistema de posiscionamiento global
Gps sistema de posiscionamiento globalGps sistema de posiscionamiento global
Gps sistema de posiscionamiento global
 
Material de suturas
Material de suturasMaterial de suturas
Material de suturas
 

Similar to The New Massachusetts Privacy Rules (February 2, 2010)

The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4
stevemeltzer
 
The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4
stevemeltzer
 
Data Risks In A Digital Age
Data Risks In A Digital Age Data Risks In A Digital Age
Data Risks In A Digital Age
padler01
 
Law firm information security overview focus on encryption by dave cunningh...
Law firm information security overview   focus on encryption by dave cunningh...Law firm information security overview   focus on encryption by dave cunningh...
Law firm information security overview focus on encryption by dave cunningh...
David Cunningham
 
Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010
madamseane
 
Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0
stevemeltzer
 
f6_cyber_security_and_your_agency.pdf
f6_cyber_security_and_your_agency.pdff6_cyber_security_and_your_agency.pdf
f6_cyber_security_and_your_agency.pdf
Surendhar57
 
Contractor Responsibilities under the Federal Information Security Management...
Contractor Responsibilities under the Federal Information Security Management...Contractor Responsibilities under the Federal Information Security Management...
Contractor Responsibilities under the Federal Information Security Management...
padler01
 
AgendaIntroduction Administrative Controls Physical Contro.docx
AgendaIntroduction Administrative Controls Physical Contro.docxAgendaIntroduction Administrative Controls Physical Contro.docx
AgendaIntroduction Administrative Controls Physical Contro.docx
daniahendric
 

Similar to The New Massachusetts Privacy Rules (February 2, 2010) (20)

The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4
 
The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4The New Massachusetts Privacy Rules V4
The New Massachusetts Privacy Rules V4
 
Data Risks In A Digital Age
Data Risks In A Digital Age Data Risks In A Digital Age
Data Risks In A Digital Age
 
Data Privacy Introduction
Data Privacy IntroductionData Privacy Introduction
Data Privacy Introduction
 
Mass 201 CMR 17 Data Privacy Law
Mass 201 CMR 17 Data Privacy LawMass 201 CMR 17 Data Privacy Law
Mass 201 CMR 17 Data Privacy Law
 
Law firm information security overview focus on encryption by dave cunningh...
Law firm information security overview   focus on encryption by dave cunningh...Law firm information security overview   focus on encryption by dave cunningh...
Law firm information security overview focus on encryption by dave cunningh...
 
Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010
 
STUCOR_CS8792-LL.pdf
STUCOR_CS8792-LL.pdfSTUCOR_CS8792-LL.pdf
STUCOR_CS8792-LL.pdf
 
Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0
 
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
 
f6_cyber_security_and_your_agency.pdf
f6_cyber_security_and_your_agency.pdff6_cyber_security_and_your_agency.pdf
f6_cyber_security_and_your_agency.pdf
 
Unit 6 Privacy and Data Protection 8 hr
Unit 6  Privacy and Data Protection 8 hrUnit 6  Privacy and Data Protection 8 hr
Unit 6 Privacy and Data Protection 8 hr
 
An Overview of the Major Compliance Requirements
An Overview of the Major Compliance RequirementsAn Overview of the Major Compliance Requirements
An Overview of the Major Compliance Requirements
 
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
 
Advisory April Showers 02.19.2009
Advisory April Showers 02.19.2009Advisory April Showers 02.19.2009
Advisory April Showers 02.19.2009
 
Contractor Responsibilities under the Federal Information Security Management...
Contractor Responsibilities under the Federal Information Security Management...Contractor Responsibilities under the Federal Information Security Management...
Contractor Responsibilities under the Federal Information Security Management...
 
AgendaIntroduction Administrative Controls Physical Contro.docx
AgendaIntroduction Administrative Controls Physical Contro.docxAgendaIntroduction Administrative Controls Physical Contro.docx
AgendaIntroduction Administrative Controls Physical Contro.docx
 
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to SuccessAddressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
 
Information security
Information securityInformation security
Information security
 
FLIGHT Amsterdam Presentation - Data Breaches and the Law: A Practical Guide
FLIGHT Amsterdam Presentation - Data Breaches and the Law: A Practical GuideFLIGHT Amsterdam Presentation - Data Breaches and the Law: A Practical Guide
FLIGHT Amsterdam Presentation - Data Breaches and the Law: A Practical Guide
 

Recently uploaded

Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 

Recently uploaded (20)

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Cyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfCyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdf
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 

The New Massachusetts Privacy Rules (February 2, 2010)