Can a WISP be executed electronically?

Yes. Electronic execution is enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided the signature captures intent, consent, attribution, and the record can be retained and reproduced. Confirm industry exceptions such as wills or court filings.

Who must sign the WISP and approve changes?

Typically the policy owner and an authorized executive sign final approvals. Delegated owners operate controls, update procedures, and coordinate training. Maintain recorded approvals and dates to demonstrate governance; include legal counsel sign-off for compliance-impacting changes.

Is notarization or witness required for a WISP policy?

Generally no. WISP policies are internal governance documents and typically do not require notarization or witnesses. However, specific state laws or contractual obligations may require executed attestations or certificates; verify requirements for regulated industries or when attestation will be submitted to external authorities.

Can the WISP be customized for different business units?

Yes. Use the template's modular sections to create unit-specific appendices or control matrices. Maintain a master policy and unit-level attachments that reference common controls, ensuring consistent governance while documenting variations and responsible owners for each business unit.

How often must the WISP be reviewed and updated?

At minimum, perform an annual review and after material changes such as major system deployments, mergers, breaches, or regulatory updates. Document review dates, findings, and remediation actions to support auditability and continuous improvement of security controls.

How should signed WISP records be stored securely?

Store signed records in encrypted, access-controlled repositories with retention policies and versioning. Maintain immutable audit trails recording signer identity, timestamp, and document hash. For regulated data, ensure storage regions comply with applicable data residency and BAA requirements.

Electronic Signature
Templates
Miscellaneous
Business WISP Template

Business WISP Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Business WISP Template

This Written Information Security Program ("WISP") is entered into between the parties identified below for the protection of nonpublic information and the establishment of administrative, technical, and physical safeguards.

Parties

Company Name Service Provider Name

Recitals

WHEREAS, Company Name: maintains nonpublic information concerning its customers, employees and operations that requires reasonable administrative, technical and physical safeguards; and

WHEREAS, Service Provider Name: will have access to or control over certain categories of Confidential Information in the course of providing services described herein; and

WHEREAS, the parties wish to set forth a Written Information Security Program establishing required safeguards, incident response obligations, and audit and oversight rights.

Scope of Work

Description of Services and WISP Scope

The Service Provider shall develop, implement, maintain, and operate policies, procedures and technical measures sufficient to protect Confidential Information pursuant to this WISP and applicable law. The WISP shall include, at a minimum, access controls, encryption where appropriate, secure disposal, employee training, and an incident response procedure.

Information and Security Contacts

Company Security Officer Company Contact Email Service Provider Security Officer Service Provider Contact Email

Types of Data Covered

Categories of Confidential Information

Technical and Administrative Safeguards

Technical Safeguards (encryption, access controls, logging) Administrative Safeguards (training, background checks, policies)

Incident Response and Notification

The Service Provider shall implement a documented incident response plan and shall notify Company without unreasonable delay upon discovery of any security incident affecting Confidential Information. Notification shall include the nature of the incident, categories of data affected, known or suspected impact, and steps taken to contain and remediate the incident.

Incident Response Procedure Summary

Payment Terms

Company shall pay Service Provider for the services and WISP implementation in accordance with the amounts and schedule below. Invoices shall be payable in United States Dollars unless otherwise agreed in writing.

Total Fee Payment Schedule and Milestones Late Payment Fee

Term and Termination

This WISP commences on Effective Date: and continues until End Date: unless earlier terminated pursuant to this section.

Either party may terminate for convenience upon days' prior written notice. Either party may terminate immediately for material breach that is not cured within thirty (30) days after written notice of breach. Termination shall not relieve Service Provider of obligations concerning Confidential Information accrued prior to termination.

Confidentiality

"Confidential Information" means any nonpublic information disclosed by Company to Service Provider, whether oral, written, or electronic, including but not limited to customer data, employee records, financial information, software, designs, and technical documentation. Confidential Information does not include information that (a) is or becomes generally available to the public without breach of this WISP, (b) was rightfully known to Service Provider prior to disclosure, or (c) is rightfully received from a third party without restriction.

Service Provider shall: (i) use Confidential Information solely for the purpose of performing its obligations under this WISP; (ii) restrict disclosure to employees, contractors, and agents who need access to perform services and who are bound by confidentiality obligations at least as protective as those herein; and (iii) implement commercially reasonable administrative, technical and physical safeguards to protect Confidential Information.

Confidentiality Duration (years)

Breach of confidentiality will entitle Company to injunctive relief in addition to any other remedies available at law or equity.

Audit and Compliance

Upon reasonable prior notice, Service Provider shall permit Company or an independent auditor engaged by Company to assess Service Provider's compliance with the WISP and applicable security obligations, including onsite inspections and review of policies, procedures and technical controls. Audit scope, notice and confidentiality of audit findings shall be reasonably coordinated to minimize operational disruption.

Representations and Warranties

Each party represents that it has the authority to enter into this WISP, and Service Provider warrants that its services and security measures will materially conform to the descriptions provided herein and will be performed in a professional and workmanlike manner consistent with industry standards.

Limitation of Liability

Except for breaches of confidentiality or indemnification obligations, neither party shall be liable to the other for consequential, incidental, special or punitive damages. The parties' aggregate liability for direct damages arising from this WISP shall be limited to the fees paid by Company to Service Provider under this WISP during the twelve (12) months preceding the claim.

Governing Law

This WISP shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles.

Entire Agreement

This WISP, together with any exhibits and statements of work expressly incorporated by reference, constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes all prior or contemporaneous agreements, understandings, negotiations and discussions, whether oral or written.

Miscellaneous

Any amendment to this WISP must be in writing and signed by authorized representatives of both parties. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Company:

By:

Date:

Service Provider:

By:

Date:

What the Business WISP Template Is

The Business WISP Template is a written information security program tailored for small and mid-size companies to document administrative, technical, and physical safeguards for protecting sensitive business and customer data. It provides standardized sections for roles and responsibilities, risk assessment procedures, access control policies, incident response plans, data classification, vendor management, employee training, and monitoring. The template is designed as a starting point that organizations customize for size, industry, and regulatory obligations such as HIPAA or GLBA. Use it to create a repeatable, auditable program that supports compliance and operational consistency across departments.

Why a Structured WISP Template Matters

A Business WISP Template centralizes security policies and procedures so organizations can consistently manage risk, demonstrate due diligence, and provide evidence for audits or third-party assessments. It reduces ambiguity in responsibilities and helps align controls with contractual or regulatory obligations.

Who Typically Uses and Signs a WISP

Typical users and signers include internal security leads, HR, IT, compliance, vendors, and external auditors.

Small and mid‑size businesses building documented security controls across departments.
Managed service providers and vendors that must meet customer security requirements.
Compliance officers preparing evidence for HIPAA, GLBA, or contract audits.

The template supports collaboration among legal, technical, and business stakeholders and helps document approvals and version history for governance.

Essential Sections to Include in the Business WISP Template

Core sections of a professional Business WISP Template define policy scope, controls, roles, incident response, vendor oversight, and monitoring metrics.

Scope

Define covered systems, data classifications, geographic locations, and business units. Clearly state exclusions and interfaces with third parties so responsibilities and applicability are unambiguous during audits and incident investigations.

Roles

List specific role names, assignments, and authority levels for policy owners, approvers, system administrators, and incident response team members, including contact details and escalation paths for compliance and operational continuity.

Controls

Document technical and administrative controls such as access control, encryption, backups, patch management, logging, and least-privilege practices, with references to standards used and required monitoring frequencies.

Incident Response

Include detection procedures, reporting lines, containment and recovery steps, communication templates, forensic evidence preservation, and post-incident reviews with timelines and responsible parties and regulatory notification requirements.

Vendor Management

Require security questionnaires, contract clauses, SLA metrics, audit rights, and periodic reassessments for third-party vendors that access or process sensitive data, including required certifications or proof of controls.

Monitoring & Metrics

Specify logging requirements, KPIs, reporting cadence, dashboard owners, and review procedures to demonstrate control effectiveness and support audit sampling or continuous improvement efforts with retention requirements.

Step-by-Step: Complete and Approve Your WISP

Follow these sequential steps to complete and approve a Business WISP Template within your organization.

01

Prepare Draft: Gather current policies, asset inventory, and risk assessments.
02

Assign Owners: Designate role owners for each policy and control area.
03

Review & Revise: Conduct cross-functional review and incorporate legal feedback.
04

Approve & Publish: Obtain executive sign-off, publish version, and communicate changes.

Configure an Electronic Approval Workflow

Configure an electronic workflow that captures approvals, audit logs, and version control for the Business WISP Template.

Field	Configuration
Signing Order	Sequential or parallel signer order.
Authentication	Email link, SMS code, or KBA.
Retention Storage	Encrypted cloud storage with versioning.
Notifications	Automated reminders and approval escalations.

Where to File and Send the Final WISP

Typical routing paths for a completed Business WISP Template and where finalized copies should be sent or filed.

Internal Records: Store signed copy in centralized GRC or document repository.
Legal: Provide final version to in-house counsel for retention.
Auditors: Share compiled evidence package with auditors or assessors.
Vendors: Distribute relevant sections to vendors under contract clauses.

Technical Requirements for eSignatures and Storage

For eSignature and eSubmission, ensure the chosen platform supports secure signer authentication, detailed audit trails, encrypted storage, and configurable retention policies to meet regulatory requirements.

Authentication: Email, SMS, or SSO options.
Integrations: Connectors for CRM, ERP, and cloud storage.
Document Formats: Accept PDF, DOCX, and HTML.

Timing Expectations for Drafting and Approval

Key timing expectations and common review intervals when creating, approving, and periodically updating a Business WISP Template.

Initial Draft:

Allow two to four weeks for cross-functional drafting and consolidation.

Legal Review:

Allow one to two weeks for counsel review and redline.

Executive Approval:

Plan for up to one week for sign-off and scheduling.

Annual Review:

Schedule an annual review or sooner after major changes.

Incident Update:

Update within 30 days after a significant security incident.

Key Milestones and Who Owns Them

Milestones and responsible parties for WISP approval, publication, employee training, and periodic reassessment across the organization.

01

Draft Complete

Finalize draft and compile evidence package for review.

02

Legal Sign-off

Counsel approves language and compliance references.

03

Executive Approval

Authorized executive signs and records final version.

04

Training & Distribution

Publish policy and conduct mandatory employee training.

Common Preparation Challenges to Avoid

Failing to tailor scope to actual systems leads to gaps where unprotected data remains in production systems and is overlooked during incident response.
Using generic control descriptions without measurable metrics prevents objective auditing and makes evidence collection time-consuming for both internal and external assessors.
Assigning ownership without documented authority or contact details creates delays when approvals or emergency decisions are required.
Neglecting to update the template after major system changes leads to outdated policies that fail to reflect current controls or compliance posture.

Risks and Consequences of an Incomplete or Incorrect WISP

Compliance Gaps: Regulatory fines or corrective orders

Breach Exposure: Increased likelihood of data incidents

Contract Risk: Loss of vendor or client contracts

Audit Failure: Unsubstantiated controls and findings

Operational Delay: Confusion over responsibilities

Legal Liability: Potential litigation and indemnity claims

Security and Compliance Controls to Reference

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Certifications: SOC 2 Type II, ISO 27001, PCI DSS

Compliance: ESIGN, UETA, HIPAA (BAA available), 21 CFR Part 11

Access Controls: Role-based access and MFA support

Audit Trail: Timestamped logs with signer attribution

Data Residency: Configurable storage regions and export options

Pricing and Feature Snapshot for Common eSignature Vendors

Quick vendor feature and pricing comparison focused on eSignature options commonly used to execute a Business WISP Template.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the Business WISP Template

Frequently asked questions about completing, approving, and storing a Business WISP Template, and answers to common process issues.

Need help? Contact support

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now