Scope
Define systems, data types, and environments covered by the declaration and any exclusions or sub‑processors in scope.
A clear Business Security Declaration reduces ambiguity during procurement and contracting, supports compliance reviews, and sets measurable expectations for data protection and incident response. It creates an auditable record of assurances that legal, security, and procurement teams can reference during disputes or audits.
Typical authors and recipients span legal, security, procurement, and external counterparties.
The document helps align technical controls with contractual obligations and creates a single reference for ongoing verification and audits.
Define systems, data types, and environments covered by the declaration and any exclusions or sub‑processors in scope.
Summarize technical and organizational controls such as encryption, access control, logging, vulnerability management, and patching cadence.
List applicable frameworks and standards (HIPAA, SOC 2, ISO 27001, PCI DSS) and indicate attestation or certification status.
Assign ownership for security functions, contact points for incidents, and timelines for remediation and reporting.
Describe detection, escalation, notification windows, forensic handling, and customer notification procedures.
State the frequency of updates, review owners, and triggers for change such as major product releases or breaches.
| Field | Configuration |
|---|---|
| Template name | Use consistent naming with version number |
| Required fields | Make legal name, effective date, and signature mandatory |
| Authentication | Require email + optional SMS or KBA for higher assurance |
| Retention settings | Enable automatic export/PDF and secure storage |
Select platforms and formats that preserve signatures, metadata, and audit trails.
Use storage that enforces access controls and retains an immutable audit trail to support later verification or dispute resolution.
Date obligations begin; affects enforcement and retention
Complete technical validation within 14–30 days
Revalidate controls at least once per year
Notify counterparties per contract or applicable law
Begin retention count from effective or execution date
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes (Business Premium+) | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |