What is a Written Information Security Program?

A Written Information Security Program (WISP) is a comprehensive security policy document that describes how your organization protects personal information. It defines the administrative, technical, and physical safeguards your business implements to prevent unauthorized access, data breaches, and information theft.

Think of a WISP as the security playbook for your business. It answers questions like: Who has access to sensitive data? How is that data encrypted? What happens when an employee leaves? What is the plan if there is a data breach? How are vendors assessed for security compliance?

Who Needs a WISP?

Any business that stores, processes, or transmits personal information should have a WISP. Personal information includes names combined with Social Security numbers, financial account numbers, credit card data, driver license numbers, health information, or biometric data.

• Massachusetts 201 CMR 17.00 — explicitly requires a WISP for anyone storing personal information of MA residents, regardless of where your business is located
• IRS Publication 4557 — requires tax preparers to create and implement a written security plan
• HIPAA — covered entities must maintain documented security policies and procedures
• PCI-DSS — merchants handling payment card data need documented security policies
• Cyber liability insurance — many insurers now require a WISP as a condition of coverage
• State data security laws — California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and Utah (UCPA) all have data security requirements that a WISP addresses

What EezyCorp WISP Includes

• Customized security policy document — tailored to your industry, data types, and business operations
• Risk assessment workbook — identify threats, vulnerabilities, and risk levels for your specific environment
• Data classification framework — categorize information by sensitivity and define handling requirements for each level
• Access control policies — define who has access to what data and under what conditions
• Encryption and data protection standards — specify encryption requirements for data at rest and in transit
• Incident response plan — step-by-step procedures for detecting, containing, and recovering from security incidents
• Employee training program — security awareness training with acknowledgment tracking and completion records
• Vendor security assessment templates — evaluate third-party providers who access your data
• Physical security procedures — policies for physical access to facilities, equipment, and paper records
• Annual review framework — guided annual review process with automated reminders

The Cost of Not Having a WISP

In Massachusetts, penalties for WISP violations can reach $5,000 per violation. But the real cost comes after a data breach: notification expenses averaging $150 per affected record, legal fees, regulatory investigations, and the reputational damage that drives customers away. Cyber liability insurers may deny your claim if you lack a documented security program. A WISP costs a fraction of what a single data breach costs.