I guess this is what happens when you are the home state of TJX and BJ's Wholesale.

Massachusetts has passed a regulation that adds *significant* prescribed security controls in support of their data privacy regulation passed in 2007. The new regulations require (for businesses that process or store the PII of Massachusetts residents) security programs with these controls in place:

- written information security program
- passwords, encryption for laptops
- risk assessments
- security policies around records retention
- policies and procedures to prevent terminated employees from gaining access
- physical access control policies and procedures
- security incident response policies
- monitoring for unauthorized access
- encryption of PII on laptops and other portable devices
- encryption of PII data in transmission

Massachusetts sets the new high water mark for privacy legislation, and the degree to which they are prescribing specific security controls.

The regulation becomes effective 1/1/2009. Enforcement is up to the Massachusetts Attorney General, and the legislation applies to businesses anywhere that have MA residents in their databases.

Most of these security controls are best practices sorts of things, and they are the kinds of things that you see in GLBA, PCI DSS, ISO 27002, and other regulations and industry standards. So they shouldn't come as much surprise to large businesses. But the existence of this new state regulation adds to your risks if  you get security wrong, and it should further help to justify security spending to management.

Jim