Can this report be signed electronically?

Yes. Electronic signatures meet federal standards under the ESIGN Act (15 U.S.C. ch. 96, 2000) and are accepted in most states under UETA; ensure signer intent, consent, attribution, and record retention are documented.

Do I need a notary or witness?

Usually no for internal incident reports; if the document will be used as a sworn statement, deed, or other notarized filing, follow state notary rules and RON status as applicable.

How should PHI be handled in the report?

Limit PHI to essential details, follow HIPAA safeguards, and coordinate with privacy counsel; maintain a separate log of disclosures when notifications are required.

What if evidence is modified accidentally?

Document the change immediately, note the reason and personnel involved, and preserve original copies where available; uncontrolled modification can jeopardize admissibility and insurance claims.

Which retention rules apply?

Follow federal and industry standards (e.g., IRS recordkeeping, HIPAA 45 CFR §164.530(j)) and any contractual or state requirements; err on the side of longer retention if litigation is possible.

How do I authenticate external signers?

Use appropriate authentication strength based on risk: email link for low risk, SMS or multi-factor for higher risk, and KBA or advanced authentication where regulatory or evidentiary standards demand it.

Electronic Signature
Templates
Miscellaneous
Business Attack Document

Business Attack Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS ATTACK DOCUMENT

This Business Attack Document (the Agreement) is entered into effective as of Effective Date: by and between Party A: and Party B: .

WHEREAS, Party A desires to engage Party B to undertake a directed, lawful competitive and market operations program as described herein; and

WHEREAS, Party B represents that it has the experience, personnel and lawful authority to perform the services contemplated under this Agreement; and

WHEREAS, the parties wish to set forth the terms, payment and responsibilities governing the engagement and to allocate risk between them.

Scope of Work

Party B will perform the services and deliverables described below (collectively, the Services). Party B shall perform the Services in a professional manner consistent with industry standards and in compliance with all applicable laws.

Detailed Scope of Work

Payment Terms

As consideration for the Services, Party A shall pay Party B the fees set forth below. All payments are due in U.S. dollars unless otherwise agreed in writing.

Total Fee Payment Schedule Deposit Required (if any) Late Payment

Overdue payments shall bear interest at , compounded monthly, or the maximum rate permitted by law, whichever is lower.

Expense Reimbursement

Party A shall reimburse Party B for pre-approved out-of-pocket expenses incurred in connection with the Services. Party B must obtain written approval prior to incurring any single expense exceeding .

Term and Termination

This Agreement commences on Start Date: and continues until End Date: , unless earlier terminated in accordance with this Section.

Termination for Convenience

Either party may terminate this Agreement for convenience upon written notice to the other party delivered not less than days prior to the intended termination date.

Termination for Cause

Either party may terminate this Agreement immediately upon written notice if the other party materially breaches any provision of this Agreement and fails to cure such breach within 15 days after receipt of written notice specifying the breach.

Confidentiality

Each party (Receiving Party) shall keep confidential and not disclose to any third party any Confidential Information of the other party (Disclosing Party) except as required to perform the Services. Confidential Information includes business plans, pricing, customer lists, tactics, and any non-public information disclosed in connection with this Agreement.

Confidentiality obligations shall remain in effect for a period of years following the termination or expiration of this Agreement, except for information that becomes public other than by breach of this Agreement.

Notwithstanding the foregoing, Confidential Information does not include information that: (a) is or becomes publicly known through no wrongful act of the Receiving Party; (b) was already known to the Receiving Party prior to disclosure; or (c) is rightfully obtained from a third party without breach of any obligation of confidentiality.

Compliance and Conduct

Party B shall conduct all activities and tactics under this Agreement in strict compliance with all applicable laws, rules and regulations. Party B shall not undertake any activity that reasonably would be expected to violate law, invade privacy, infringe intellectual property rights, constitute defamation, involve misrepresentation, or otherwise expose Party A to legal liability. Party B shall indemnify and hold Party A harmless from any claims, damages or penalties arising from Party B's breach of this Section.

Intellectual Property; Deliverables

Unless otherwise agreed in writing, all Deliverables created specifically for Party A under this Agreement shall be deemed work made for hire and, upon full payment, ownership of such Deliverables shall vest in Party A. Party B retains ownership of its underlying methodologies, templates and pre-existing materials, provided that Party B grants Party A a non-exclusive license to use such materials to the extent embodied in the Deliverables.

Indemnification and Limitation of Liability

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims arising from its gross negligence, willful misconduct, or breach of this Agreement. EXCEPT FOR A PARTY'S INDEMNIFICATION OBLIGATIONS OR A PARTY'S BREACH OF CONFIDENTIALITY OR WILLFUL MISCONDUCT, NEITHER PARTY SHALL BE LIABLE FOR INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR SPECIAL DAMAGES. THE AGGREGATE LIABILITY OF EITHER PARTY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE TO PARTY B UNDER THIS AGREEMENT.

Notices

Party A Notice Address Party B Notice Address

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflicts of law principles. Exclusive jurisdiction and venue for any dispute arising under this Agreement shall be the state and federal courts located in that State.

Entire Agreement

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

Acknowledgment and Warning

The parties acknowledge that certain competitive tactics may carry legal and reputational risk. Party B affirms that it will not advise or undertake actions that are unlawful or that would reasonably foreseeably subject Party A to material regulatory or civil liability. Party A represents that it will not request or authorize Party B to engage in unlawful conduct. Any conduct in breach of this representation shall be a material breach of this Agreement.

Party A - Print Name:

By:

Date:

Party B - Print Name:

By:

Date:

What the Business Attack Document Is and When It’s Used

A Business Attack Document is a structured incident record created when a company experiences a cyber, physical, or hybrid attack. It captures facts, timelines, affected systems or assets, evidence preservation steps, initial impact assessment, notifications made to stakeholders, and recommended next steps. The document supports insurance claims, regulatory reporting, law enforcement referrals, and internal remediation plans. When personal health information or student records are involved, the document must align with HIPAA or FERPA obligations and may trigger specific disclosure or retention rules.

Why a Clear Attack Report Matters

A concise Business Attack Document preserves evidence, speeds response, and creates a single authoritative record for insurers, counsel, regulators, and law enforcement while supporting consistent post‑incident decisions.

Who Typically Prepares and Reviews This Document

Organizations use this document to coordinate technical, legal, and business responses after an attack.

Security operations teams and incident responders who gather technical details and timeline information for remediation.
Legal and compliance teams who assess regulatory obligations and prepare notifications to regulators or affected individuals.
Executives, risk managers, and insurers who need a concise summary for decision-making and claim support.

A well-structured report reduces confusion and supports claims, investigations, and remediation across internal and external stakeholders.

Authority and Signatory Roles

Chief Security Officer

The Chief Security Officer commonly certifies technical findings and approves remediation steps. Their signature indicates that the attack narrative and containment actions are accurate, and that technical evidence has been preserved according to internal chain‑of‑custody procedures.

General Counsel

The General Counsel typically signs to confirm legal review and to authorize any regulatory or law enforcement notifications. Their approval signals the document has been reviewed for privilege, disclosure risk, and compliance with notification obligations.

Essential Security and Compliance Details to Include

Evidence Chain: Preservation steps and custody

Systems Affected: Names, IPs, and versions

Incident Timeline: Discovery to containment

Data Types: PHI, PII, financial data

Notifications: Insurer, law enforcement, regulators

Technical Logs: Hashes, timestamps, snapshots

Step-by-Step: Assemble the Attack Document

Follow this sequence to create a defensible, usable incident record that supports technical, legal, and business needs.

01

Gather evidence: Collect logs, snapshots, and chain‑of‑custody notes
02

Document timeline: Record discovery, escalation, and containment timestamps
03

Assess data: Identify exposed data types and likely scope
04

Record actions: List notifications, remediation, and responsible parties

Configure an Online Workflow for the Document

Set up roles, authentication, and routing to ensure consistent completion and secure access.

Field	Configuration
Uploader and owner	Assign incident owner and upload permissions
Signer roles	Specify technical, legal, and executive signers
Authentication level	Use multi-factor or KBA as needed
Retention rule	Set automated archival and access controls

Typical Routing and Submission Flow

A clear routing path reduces delays and ensures each discipline reviews the document in order.

Incident Owner: Prepares the draft and attaches evidence
Security Review: Validates technical findings and adds logs
Legal Review: Assesses disclosure obligations and privilege
Executive Sign-off: Approves final report and communications

Typical Platforms and File Formats for eSubmission

Choose platforms that support secure PDF or DOCX exports, audit trails, and strong signer authentication.

Integrations: Salesforce, NetSuite, Microsoft 365 support
File formats: PDF, DOCX, and Excel supported
Authentication: SMS, email, or advanced options

Ensure the selected platform preserves an audit trail, secures attachments, and meets any applicable compliance requirements such as HIPAA or 21 CFR Part 11.

Common Internal Deadlines and Expectations

Define internal deadlines to keep response and reporting consistent across teams and to meet external obligations.

Evidence preservation:

Immediate — preserve logs and system images

Initial report:

Within 24–72 hours to internal stakeholders

Insurance notification:

Per policy; notify promptly to preserve coverage

Regulatory assessment:

Complete within legal windows when required

Final report delivery:

After investigation and remediation steps complete

Key Milestones from Detection to Closure

Track these milestones to document progress and support later audits or claims.

01

Detection and Triage

Identify event and determine priority for response

02

Containment

Limit spread and secure affected systems

03

Investigation

Collect forensic data and determine root cause

04

Remediation and Closure

Apply fixes, validate recovery, and close the incident

Common Preparation Mistakes to Avoid

Delaying evidence capture which can destroy logs or forensic artifacts and weaken insurance or legal claims.
Using inconsistent date/time formats across entries, making timeline reconstruction and correlation difficult for forensics.
Failing to document who accessed evidence, undermining chain of custody and potential privilege arguments.
Omitting affected data categories (PHI/PII), which can delay notifications and increase regulatory risk.

Potential Consequences of an Incomplete or Incorrect Report

Insurance denial: Claim may be rejected

Regulatory fines: Penalties and enforcement actions

Civil liability: Damages from affected parties

Evidence spoliation: Forensic findings undermined

Operational disruption: Extended downtime and costs

Reputational harm: Loss of customer trust

eSignature Pricing Snapshot for Attack Document Workflows

Compare common vendor pricing and capability differences for eSignature needs; signNow is listed first for parity in evaluation.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

Real-World Examples of Digital Incident Documentation

These examples show how organizations use structured digital workflows and eSignature to document incidents and preserve evidence.

Optica Ventures (Brian Fitzgibbons)

Optica implemented a simple digital workflow for customer-facing incident records to reduce turnaround time.

The interface is simple and easy-to-use for our team.
The team noted faster acknowledgements from customers and consistent evidence collection, which streamlined follow-up and reduced disputes during claims.

BIS (Dan Rotelli)

BIS prioritized certified platforms for compliance and auditability in incident documentation.

We felt most comfortable with airSlate SignNow given their SOC 2 certification and strict focus on ESIGN and UETA act compliance.
Using a certified platform provided clearer audit trails during investigations and helped address governance questions from partners.

Practical Tips for Accurate and Efficient Reporting

Adopt consistent formats, preserve evidence promptly, and use role‑based routing to streamline reviews and approvals.

Standardize timestamps

Use a single timezone and format for all entries to simplify correlation across logs and forensic reports.

Document chain of custody

Record who collected each artifact, when, and how it was preserved to support admissibility and insurer reviews.

Limit privileged drafts

Separate privileged legal analysis from operational facts to protect privilege while keeping factual records accessible.

Use conditional fields

Design forms to surface PHI/PII sections only when relevant, reducing unnecessary exposure and easing reviewer focus.

Frequently Asked Questions About Business Attack Documents

Answers to common questions about creating, signing, and storing a Business Attack Document to support response and compliance.

Need help? Contact support

Can this report be signed electronically?
Yes. Electronic signatures meet federal standards under the ESIGN Act (15 U.S.C. ch. 96, 2000) and are accepted in most states under UETA; ensure signer intent, consent, attribution, and record retention are documented.
Do I need a notary or witness?
Usually no for internal incident reports; if the document will be used as a sworn statement, deed, or other notarized filing, follow state notary rules and RON status as applicable.
How should PHI be handled in the report?
Limit PHI to essential details, follow HIPAA safeguards, and coordinate with privacy counsel; maintain a separate log of disclosures when notifications are required.
What if evidence is modified accidentally?
Document the change immediately, note the reason and personnel involved, and preserve original copies where available; uncontrolled modification can jeopardize admissibility and insurance claims.
Which retention rules apply?
Follow federal and industry standards (e.g., IRS recordkeeping, HIPAA 45 CFR §164.530(j)) and any contractual or state requirements; err on the side of longer retention if litigation is possible.
How do I authenticate external signers?
Use appropriate authentication strength based on risk: email link for low risk, SMS or multi-factor for higher risk, and KBA or advanced authentication where regulatory or evidentiary standards demand it.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now