Establishing secure connection…Loading editor…Preparing document…

CII Information Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CII Information Form

Parties and Identification

Recitals

WHEREAS, Client desires to disclose certain critical information infrastructure (CII) data and related operational details to Provider for the purpose of evaluation, advisory, maintenance, or delivery of contracted services; and

WHEREAS, Provider represents that it possesses the qualifications, technical capabilities, and security controls reasonably required to receive, process, and protect CII in accordance with applicable contractual obligations described herein; and

WHEREAS, the parties intend by this document to record specified information about the CII assets, the scope of services to be performed, payment terms, and binding contractual protections; therefore the parties agree as follows:

Effective Date

Effective Date:

Scope of Work

The Provider shall perform the services described below as they relate to Client's CII assets, including but not limited to assessment, maintenance, data handling, and reporting. Services shall be performed in a manner consistent with industry-standard security practices and any specific controls enumerated in this form.

CII Asset Inventory

Provide a concise inventory of CII assets, locations, and classifications. Attach additional documentation if required and reference attachments in the inventory field below.

Physical infrastructure plans    Control system configurations    Personal or operator information    Other

Security Controls and Retention

Payment Terms

Compensation for the services described in this form shall be paid according to the terms set forth below. All payments are due in U.S. dollars unless otherwise agreed in writing.

Term and Termination

This agreement shall commence on the Start Date and continue until the End Date unless earlier terminated in accordance with this section.

Start Date:

End Date:

Either party may terminate for material breach by providing written notice to the other party and allowing a cure period equal to the notice period above unless the breach involves unauthorized disclosure of CII in which case termination may be immediate and without prejudice to other remedies.

Confidentiality and Handling of CII

Provider shall treat all CII and any related documentation, system access, or operational details as Confidential Information. Confidential Information shall not be used or disclosed except as necessary to perform the services and only to those employees, contractors, or agents with a demonstrated need to know and who are contractually bound to maintain confidentiality and security at least as protective as provided herein.

Provider will implement administrative, physical, and technical safeguards appropriate to the sensitivity of the CII, including access controls, encryption where applicable, logging of privileged access, and prompt notification to Client of any unauthorized access, loss, or disclosure. Notification shall include a description of affected information, actions taken, and recommended mitigation.

Indemnification and Liability

Each party agrees to indemnify, defend, and hold harmless the other party from losses, liabilities, damages, and reasonable costs (including reasonable attorneys' fees) arising from the indemnifying party's breach of its obligations hereunder, negligent acts or willful misconduct related to the handling of CII, or violation of applicable law. Except for indemnification obligations and willful misconduct, neither party shall be liable for incidental, consequential, or punitive damages.

Governing Law and Dispute Resolution

This agreement shall be governed by and construed in accordance with the laws of the jurisdiction indicated below without regard to its conflict of laws principles. The parties agree to attempt good faith negotiation for any dispute and, if unresolved, to submit disputes to the courts of the chosen jurisdiction.

Entire Agreement

This CII Information Form, together with any appendices or attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior or contemporaneous agreements, proposals, or representations, whether written or oral. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

Certifications and Acknowledgements

By signing below, the signing parties certify that the information provided in this form is true and accurate to the best of their knowledge, that they have the authority to bind their respective organizations, and that they accept the terms and obligations set forth herein including security, confidentiality, and indemnity requirements.

Client Printed Name:

By:

Date:

Provider Printed Name:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the CII Information Form is and when it’s used

The CII Information Form is a standardized information collection template used to gather identifying, contact, and contextual data about a person, organization, or asset relevant to a Controlled/Confidential Information intake process. It typically records legal names, addresses, role or affiliation, classification tags, and a short description of the information or activity being reported. Agencies and private organizations use the form to document receipt, routing, and handling instructions so records are searchable and traceable under internal policies and applicable law.

Why a clear CII Information Form matters for compliance

A well-structured CII Information Form reduces processing errors, clarifies handling requirements, and provides an audit-ready record for privacy and security reviews. Accurate capture of identity and classification fields supports consistent access controls and legal defensibility.

Why a clear CII Information Form matters for compliance

Typical users and signers of a CII Information Form

Role-based completion and clear signer attribution improve accountability and make later audits or incident responses faster and more reliable.

  • Information Security Officers and compliance staff who assign classification and handling instructions for incoming records.
  • HR, vendor management, or contract teams collecting party details tied to confidential agreements or access privileges.
  • Program or project managers who need an auditable intake record to trigger downstream approvals and controls.

Step-by-step: completing and routing the CII Information Form

Follow these sequential steps to ensure the form is complete, authenticated, and routed to the appropriate reviewers or record systems.

  • 01
    Prepare Document: Gather identification and supporting documents before beginning.
  • 02
    Complete Fields: Fill required fields with the specified formats and classification choices.
  • 03
    Authenticate Signer: Verify identity per policy (ID check, MFA, or e-authentication).
  • 04
    Route and Record: Send to reviewers and store signed copy in the records system.

How to configure an online CII Information Form workflow

Configure fields, recipient order, and authentication to match your internal classification and audit requirements.

Field Configuration
Required Fields Full name | email | classification | description
Authentication Email link or SMS code; stronger options available for high-risk data
Routing Conditional routing by classification level or department
Retention Tag Automatic metadata tag for records retention policy

Where to send and how submissions are processed

Submissions follow an intake-to-archive path; define recipients and storage targets before launching a digital workflow.

  • Intake Inbox: Forms land in a monitored intake mailbox or intake system.
  • Triage Review: Compliance reviews classification and assigns handling instructions.
  • Approval: Authorized approvers sign off if access or release is needed.
  • Archive: Store signed record in the secure records repository with metadata.

Digital submission, signing, and integration considerations

Confirm the platform meets your compliance obligations (audit logs, encryption at rest and in transit, BAA if HIPAA applies) before accepting electronic submissions.

  • Authentication: Email, SMS, KBA, or stronger MFA
  • Integrations: Connectors for SharePoint, Box, NetSuite, or Salesforce
  • File formats: PDF, DOCX, and structured exports

Security and compliance checks to include on the form

Encryption: TLS 1.2/1.3 in transit, AES-256 at rest
Audit Trail: Timestamp, IP, action log
Access Controls: Role-based permissions required
HIPAA BAA: BAA required for PHI handling
21 CFR Part 11: Use for FDA-regulated records
SOC 2 / ISO: Certifications for platform assurance

Common risks and potential penalties for incorrect forms

Data breach exposure: Regulatory fines and incident costs
HIPAA violations: 45 CFR penalties and corrective action
Tax reporting errors: IRC §6721: $60–$660+ per form
Authentication failures: Disputed signatures and repudiation risk
Retention noncompliance: Sanctions or loss of evidentiary status
Contractual breaches: Damages from improper disclosures

Key timing considerations when collecting CII data

Track submission, review, and retention start dates; certain supporting forms have statutory deadlines that may apply depending on your use case.

Immediate submission:

Submit intake data as soon as collected to start audit trail

Review window:

Establish a defined review period (e.g., 3–10 business days)

Tax reporting triggers:

Provide required tax forms on request (W-9 upon payer request)

Retention start:

Retention begins on the Effective Date or filing date

I-9 rules:

I-9 retention: 3 years from hire or 1 year from termination

Key processing milestones for the CII Information Form

A typical intake process follows discrete stages from collection to archival; define milestones and SLA targets for each stage.

01

Submission Received

The form is logged and an intake timestamp is recorded.

02

Triage & Classification

Compliance assigns classification and handling instructions.

03

Approval

Authorized approvers review and sign or reject.

04

Archive & Retain

Signed record is archived with retention metadata.

eSignature vendor comparison for CII Information Form processing

Compare baseline pricing and key capabilities relevant to secure submissions and audit-ready signatures. Confirm vendor-specific terms and HIPAA/BAA availability when handling protected health information.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies by plan Varies by plan Varies by plan Varies by plan
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Practical examples: how organizations use the CII Information Form

Real-world examples show how consistent intake reduces downstream delays and strengthens audit evidence.

Optica Ventures — Intake Streamlining

Optica standardized intake fields for vendor data

  • reduced manual validation steps
  • This produced a single searchable record that cut review time and improved handoffs between security and procurement teams.

Fertility Centers — Patient Data Handling

A clinic added HIPAA authorization and identity checks

  • required stronger signer authentication
  • The result was fewer consent disputes and clearer retention tagging for medical records.

Practical tips for accurate, efficient CII Information Form completion

Adopt consistent formats, validation checks, and clear routing to lower error rates and speed processing.

Use standardized formats
Require MM/DD/YYYY for dates, full legal names, and consistent state abbreviations to prevent mismatches.
Enable required-field checks
Validate key fields before submission to reduce incomplete records and rework.
Capture consent clearly
For consumer-facing collections, include an ESIGN disclosure and a clear consent mechanism.
Automate retention tagging
Apply metadata at intake that maps to your document retention policy and disposal schedule.

Common questions about completing and signing the CII Information Form

Answers address format, signature validity, authentication, and recordkeeping so teams can resolve frequent issues without legal review.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.