Project Citizenship, Inc. Written Information Security Program (WISP) - For Protection of Personal Information

Aug 25, 2026

Uploaded by Eden

Project Citizenship, Inc. outlines its Written Information Security Program (WISP) to protect residents’ Personal Information of the Commonwealth of Massachusetts and to comply with M.G. L. c. 93H, M.G. L. c. 93I, and 201 CMR 17.00. The program defines “Personal Information,” states the security, confidentiality, and integrity objectives, and establishes a scope for risk identification, risk assessment, safeguard evaluation, implementation, and annual monitoring. It designates a Data Security Coordinator responsible for implementation, training, testing, vendor security evaluation, and periodic review.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

General

Objective of WISP

Purpose of WISP

Scope of WISP

Data Security Coordinator

Limits on Collection and Storage of Personal Information at the Corporation

Review of WISP and Procedures

Project Citizenship, Inc. Written Information Security Program (WISP) For Protection Of Personal Information I. General A. Objective of WISP The objective of Project Citizenship, Inc. (the “Corporation”), in the development and implementation of this comprehensive Written Information Security Program (“WISP”), is to create effective administrative, technical and physical safeguards for the protection of Personal Information of residents of the Commonwealth of Massachusetts, and to comply with the Corporation’s obligations under M.G. L c. 93H, M.G. L c. 93I, and 201 CMR 17.00. The WISP sets forth the Corporation’s procedure for evaluating the Corporation’s electronic and physical methods of accessing, collecting, storing, using, transmitting, and protecting Personal Information of residents of the Commonwealth of Massachusetts. For purposes of this WISP,“Personal Information” means the following, whether in paper, electronic or other form: 1. A Massachusetts resident’s first name and last name or first initial and last name; 2. OR any or more of the following data elements that relate to such resident’s: a. Social Security number, other Taxpayer Identification Numbers, or similar identifying number; b. Driver’s license number, state-issued identification card number, or other foreign, federal, or state-issued identification document number, including A\#; c. Financial account number, or credit or debit card number (with or without any required security code, access code, personal identification number or password that would permit access to a resident’s financial account); or d. Personally identifiable health information. “Personal Information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public. “Board Member” shall mean a member of the Corporation’s board of directors with access to Personal Information. B. Purpose of WISP The purpose of the Corporation’s WISP is to: 1. Ensure the security and confidentiality of Personal Information; 2. Protect against threats or hazards to the security or integrity of such information; and 3. Protect against unauthorized access to or use of such information in a manner that creates a substantial risk of identity theft or fraud. C. Scope of WISP In formulating and implementing the Corporation’s WISP, the intended scope is to do the following: 1. Identify reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing Personal Information; 2. Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of the Personal Information; 3. Evaluate the sufficiency of existing policies, procedures, customer information systems, and other safeguards in place to control risks; 4. Design and implement a WISP that puts safeguards in place to minimize those risks, consistent with the requirements of 201 CMR 17.00; and 5. Regularly monitor the effectiveness of those safeguards, not less often than annually. D. Data Security Coordinator The Corporation has designated the Executive Director, or his or her designee, to be the Corporation’s Data Security Coordinator, which Data Security Coordinator shall currently be Mitra Shavarini. He or she will be responsible for implementing, supervising and maintaining the Corporation’s WISP, including: 1. Initial implementation of the Corporation’s WISP; 2. Training of the following persons regarding the Corporation’s WISP and Personal Information Security (a) all employees; (b) Board Members; (c) independent contractors with access to Personal Information; and (d) any other person involved with the Corporation who has or will have access to Personal Information; 3. Regular testing of the WISP’s safeguards; 4. Evaluating the ability o

FAQs

What is the objective of Project Citizenship, Inc.’s WISP?

Create effective administrative, technical, and physical safeguards to protect Massachusetts residents’ Personal Information and comply with applicable Massachusetts and 201 CMR 17.00 requirements.

What does the WISP define as “Personal Information”?

It includes a resident’s name and certain identifiers such as Social Security and tax IDs, driver’s license or state ID numbers, financial account or card numbers (including required access/security elements), and personally identifiable health information, excluding information lawfully obtained from public sources or government records made available to the general public.

Who is responsible for implementing and maintaining the WISP?

The Executive Director (or designee) is designated as the Data Security Coordinator, responsible for implementation, training, testing safeguards, evaluating third-party service provider security, and reviewing the WISP scope at least annually or upon material business changes.

Aug 25, 2026

Uploaded by Eden