SlideShare a Scribd company logo
1 of 63
The Massachusetts Data Privacy Rules Stephen E. Meltzer, Esquire, CIPP, Michelle Drolet, CEO Towerwall & Gerry Young, Secretariat Chief Information Officer
The New Massachusetts Data Security Rules
 
New Mandate: PI = PI Personal Information = Privacy Infrastructure
 
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
What Prompted the Rules? ,[object Object],[object Object],[object Object],[object Object],[object Object]
Looking Ahead ,[object Object],[object Object],[object Object],[object Object],[object Object]
Scope of Rules
Scope of Rules ,[object Object],[object Object],[object Object]
Scope of Rules ,[object Object],[object Object],[object Object],[object Object],[object Object]
Scope of Rules
Scope of Rules Bernard Madoff  Personal Financial Statement
Scope of Rules
Scope of Rules ,[object Object],[object Object],[object Object],[object Object],[object Object]
Three Requirements ,[object Object],[object Object],[object Object],[object Object]
Evaluating Compliance ( not  Evaluating Applicability ) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Evaluating Compliance ( not  Evaluating Applicability ) ,[object Object]
Enforcement ,[object Object],[object Object],[object Object],[object Object]
Comprehensive Written Information Security Program 201 CMR 17.03
Information Security Program ,[object Object]
Comprehensive Information Security Program   201 CMR 17.03 (2)(a) through (j) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object],[object Object],[object Object],[object Object],[object Object]
Comprehensive Information Security Program ,[object Object]
Breach Reporting G.L. c. 93H  §  3
Breach Reporting ,[object Object],[object Object]
Breach Reporting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Breach Reporting ,[object Object],[object Object],[object Object],[object Object]
Sample Breach Notification Letter ,[object Object]
Breach Reporting ,[object Object],[object Object],[object Object]
Computer System Security Requirements 201 CMR 17.04
Electronic Requirements 201 CMR 17.04 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
User Authentication Protocols ,[object Object],[object Object],[object Object],[object Object],Examples:  Passwords should be at least 9 characters, alpha numeric with special characters After 3 attempts to login users are blocked access
Secure Access Control Measures ,[object Object],[object Object],Example:  Network Access Control Software/Hardware  Consentry Sophos Audit control who is accessing what and when?
Encryption of Transmitted Records ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Examples: PGP and Utimaco are encryption technologies
Monitoring of Systems ,[object Object],[object Object],Examples: Again, Network Access Control Audit controls
Laptop and Mobile Device Encryption ,[object Object],[object Object],[object Object],[object Object],This applies only if you have data in motion of personal information. Email is clear text.  So anyone can read any ones email on the internet.
Security Patches and Firewalls ,[object Object],[object Object],All organizations should have a firewall in place (not a router a firewall) Can hire an organization to update and manage the security infrastructure: Firewall Anti-virus Patches…
Systems Security Agent Software ,[object Object],[object Object],[object Object],[object Object],Malware is what is infecting most enviroments.  HTTP and HTTPS traffic. Your users are your worst enemy Products to look at for Malware TrendMicro Websense Webwasher
Employee Education and IT Security Training ,[object Object],[object Object],[object Object],[object Object],[object Object],Your employees are your weakest link to any IT security program. They need to know the rules. Suggestions: Stand up training News Letters Programs Online training
The Approach ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Security is all about vigilance… Compliance is knowing what you need to protect and building a fortress around it and testing it on a frequent basis!
Data Destruction G.L. c. 93I
Data Destruction (93I) ,[object Object],[object Object],[object Object]
Data Destruction (93I) ,[object Object],[object Object],[object Object]
What To Do Now
Compliance Deadlines March 1, 2010 ,[object Object],[object Object],[object Object],[object Object],[object Object]
Tasks
Tasks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Tasks ,[object Object],[object Object],[object Object],[object Object]
Tasks ,[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Action Plan ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Resources ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Good News ,[object Object],[object Object],[object Object]
Thank You

More Related Content

What's hot

8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info Systems
Hemant Nagwekar
 
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
Biswajit Bhattacharjee
 

What's hot (19)

SingHealth Cyber Attack (project)
SingHealth Cyber Attack (project)SingHealth Cyber Attack (project)
SingHealth Cyber Attack (project)
 
Evolution of Security
Evolution of SecurityEvolution of Security
Evolution of Security
 
12 security policies
12 security policies12 security policies
12 security policies
 
Cybersecurity 101 final
Cybersecurity 101 finalCybersecurity 101 final
Cybersecurity 101 final
 
Cyber Risk Quantification for Employees | Safe Security
Cyber Risk Quantification for Employees | Safe SecurityCyber Risk Quantification for Employees | Safe Security
Cyber Risk Quantification for Employees | Safe Security
 
Topic11
Topic11Topic11
Topic11
 
Information Security vs IT - Key Roles & Responsibilities
Information Security vs IT - Key Roles & ResponsibilitiesInformation Security vs IT - Key Roles & Responsibilities
Information Security vs IT - Key Roles & Responsibilities
 
Securing information system
Securing information systemSecuring information system
Securing information system
 
Information security.pptx
Information security.pptxInformation security.pptx
Information security.pptx
 
Information security
Information security Information security
Information security
 
Chapter 2 konsep dasar keamanan
Chapter 2 konsep dasar keamananChapter 2 konsep dasar keamanan
Chapter 2 konsep dasar keamanan
 
System Security Threats and Risks)
System Security Threats and Risks)System Security Threats and Risks)
System Security Threats and Risks)
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info Systems
 
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
 
The importance of information security
The importance of information securityThe importance of information security
The importance of information security
 
Understanding Identity Management and Security.
Understanding Identity Management and Security.Understanding Identity Management and Security.
Understanding Identity Management and Security.
 
Improve Cybersecurity Education Or Awareness Training
Improve Cybersecurity Education Or Awareness TrainingImprove Cybersecurity Education Or Awareness Training
Improve Cybersecurity Education Or Awareness Training
 
Information security
Information securityInformation security
Information security
 
introduction to cyber security
introduction to cyber securityintroduction to cyber security
introduction to cyber security
 

Similar to The New Massachusetts Privacy Rules V4

Data Risks In A Digital Age
Data Risks In A Digital Age Data Risks In A Digital Age
Data Risks In A Digital Age
padler01
 
Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010
madamseane
 
Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0
stevemeltzer
 
Fundamentals of-information-security
Fundamentals of-information-security Fundamentals of-information-security
Fundamentals of-information-security
madunix
 
Keeping Client Data Safe (Final)
Keeping Client Data Safe (Final)Keeping Client Data Safe (Final)
Keeping Client Data Safe (Final)
AdvogadaZuretti
 
Law firm information security overview focus on encryption by dave cunningh...
Law firm information security overview   focus on encryption by dave cunningh...Law firm information security overview   focus on encryption by dave cunningh...
Law firm information security overview focus on encryption by dave cunningh...
David Cunningham
 
1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC
SantosConleyha
 
1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC
AbbyWhyte974
 

Similar to The New Massachusetts Privacy Rules V4 (20)

Data Privacy Introduction
Data Privacy IntroductionData Privacy Introduction
Data Privacy Introduction
 
Data Risks In A Digital Age
Data Risks In A Digital Age Data Risks In A Digital Age
Data Risks In A Digital Age
 
Mass 201 CMR 17 Data Privacy Law
Mass 201 CMR 17 Data Privacy LawMass 201 CMR 17 Data Privacy Law
Mass 201 CMR 17 Data Privacy Law
 
Cybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdfCybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdf
 
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
Discussing Cyber Risk Coverage With Your Commercial Clients by Steve Robinson...
 
Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010Mass Information Security Requirements January 2010
Mass Information Security Requirements January 2010
 
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
Safeguarding Your Business: Understanding, Preventing, and Responding to Data...
 
Information security
Information securityInformation security
Information security
 
Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0Massachusetts data privacy rules v6.0
Massachusetts data privacy rules v6.0
 
Securing Mobile Healthcare Application
Securing Mobile Healthcare ApplicationSecuring Mobile Healthcare Application
Securing Mobile Healthcare Application
 
Advisory April Showers 02.19.2009
Advisory April Showers 02.19.2009Advisory April Showers 02.19.2009
Advisory April Showers 02.19.2009
 
Unit 6 Privacy and Data Protection 8 hr
Unit 6  Privacy and Data Protection 8 hrUnit 6  Privacy and Data Protection 8 hr
Unit 6 Privacy and Data Protection 8 hr
 
security IDS
security IDSsecurity IDS
security IDS
 
Cybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for ExecutivesCybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for Executives
 
Fundamentals of-information-security
Fundamentals of-information-security Fundamentals of-information-security
Fundamentals of-information-security
 
Keeping Client Data Safe (Final)
Keeping Client Data Safe (Final)Keeping Client Data Safe (Final)
Keeping Client Data Safe (Final)
 
Law firm information security overview focus on encryption by dave cunningh...
Law firm information security overview   focus on encryption by dave cunningh...Law firm information security overview   focus on encryption by dave cunningh...
Law firm information security overview focus on encryption by dave cunningh...
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to security
 
1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC
 
1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC1. Original Post by Catherine JohnsonCryptographic MethodsC
1. Original Post by Catherine JohnsonCryptographic MethodsC
 

Recently uploaded

CORS (Kitworks Team Study 양다윗 발표자료 240510)
CORS (Kitworks Team Study 양다윗 발표자료 240510)CORS (Kitworks Team Study 양다윗 발표자료 240510)
CORS (Kitworks Team Study 양다윗 발표자료 240510)
Wonjun Hwang
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
FIDO Alliance
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
FIDO Alliance
 
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
TrustArc
 
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
Muhammad Subhan
 

Recently uploaded (20)

CORS (Kitworks Team Study 양다윗 발표자료 240510)
CORS (Kitworks Team Study 양다윗 발표자료 240510)CORS (Kitworks Team Study 양다윗 발표자료 240510)
CORS (Kitworks Team Study 양다윗 발표자료 240510)
 
How we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdfHow we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdf
 
Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
 
ERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage IntacctERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage Intacct
 
2024 May Patch Tuesday
2024 May Patch Tuesday2024 May Patch Tuesday
2024 May Patch Tuesday
 
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsContinuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
 
Google I/O Extended 2024 Warsaw
Google I/O Extended 2024 WarsawGoogle I/O Extended 2024 Warsaw
Google I/O Extended 2024 Warsaw
 
How to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cfHow to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cf
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
 
JavaScript Usage Statistics 2024 - The Ultimate Guide
JavaScript Usage Statistics 2024 - The Ultimate GuideJavaScript Usage Statistics 2024 - The Ultimate Guide
JavaScript Usage Statistics 2024 - The Ultimate Guide
 
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
Human Expert Website Manual WCAG 2.0 2.1 2.2 Audit - Digital Accessibility Au...
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
 
Design and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data ScienceDesign and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data Science
 
Intro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxIntro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptx
 
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptxCyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
 
Introduction to use of FHIR Documents in ABDM
Introduction to use of FHIR Documents in ABDMIntroduction to use of FHIR Documents in ABDM
Introduction to use of FHIR Documents in ABDM
 
AI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by Anitaraj
 
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
TrustArc Webinar - Unified Trust Center for Privacy, Security, Compliance, an...
 
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
“Iamnobody89757” Understanding the Mysterious of Digital Identity.pdf
 

The New Massachusetts Privacy Rules V4