Deadline Looms For Cloud Computing And IT Service Contract Compliance

If your corporate IT "cloud" casts a shadow in Massachusetts, you have mere weeks to finalize the compliance program for your IT service contracts or face the thunderstorm of penalties under that state's data security law. On March 1, 2012, a requirement in the Massachusetts data security regulations will go into effect requiring companies' written information security programs (WISPs) to cover cloud computing, software-as-a-service, outsourcing and other information technology service providers.

The WISP requirement itself has been in place since 2010, but now must additionally require contracts with third party IT providers to contain a provision obligating the service provider to implement and maintain "appropriate security measures" to protect covered personal information in a manner consistent with the Massachusetts regulations and federal law.