Can this be signed electronically?

Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws where adopted. Ensure the four ESIGN criteria—intent, consent, attribution, and reproducible record—are satisfied; consumer-facing records need ESIGN disclosures.

Is notarization required for the agreement?

Not typically. Standard contracts rarely require notarization, though some states permit or require Remote Online Notarization for specific document types. Verify state notary rules and preserve RON session records and notarization journals where used.

What should I do if a device is lost or stolen?

Follow the agreement's incident steps: notify IT immediately, document the incident, attempt remote lock or wipe if authorized, and escalate to legal if PHI or regulated data may be involved. Adhere to internal reporting timelines such as 24–72 hours.

Can the organization remotely wipe my personal device?

Only if the agreement includes explicit, informed consent for remote wipe. The agreement should limit scope, require notice where possible, and describe recovery options for personal data to balance privacy and security.

How long must we keep executed agreements?

Retain the executed agreement for the active term plus applicable statutory periods. For financial records follow IRS rules (IRC §6501(a)), and for healthcare retain related records six years per 45 CFR §164.530(j); state rules may extend these periods.

Are e-signatures admissible in court?

Yes. Courts accept electronic signatures when ESIGN/UETA criteria are met. Preserve the full audit trail, authentication evidence, and exact signed record to support admissibility and rebut challenges to validity.

Client CYOD Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CLIENT CYOD AGREEMENT

This Client CYOD Agreement ("Agreement") is entered into as of by and between Client Name: and Service Provider Name: (each a "Party" and collectively the "Parties").

WHEREAS

WHEREAS, Client elects to provide, select or permit the use of certain personal or third-party devices for use with Provider's services under a Choose Your Own Device (CYOD) arrangement; and

WHEREAS, Provider agrees to permit the use of such devices subject to the terms and conditions set forth in this Agreement, including device specifications, security requirements, support obligations, and payment obligations; and

WHEREAS, the Parties desire to set forth their respective rights and obligations regarding selection, use, maintenance and support of CYOD devices.

SCOPE OF WORK

Description of Services and Device Responsibilities

Device Model(s): Serial/Identifier:

Ownership of Device: Support Responsibility:

PAYMENT TERMS

Total Fees Payable Payment Schedule and Milestones

Deposit or Upfront Payment: Invoice Terms:

Late Payment

Late fee and interest: Provider may assess a late fee of on any overdue balance, and may suspend support or service for nonpayment after providing written notice as set forth in this Agreement.

TERM AND TERMINATION

Term Commencement Date: Term Expiration Date:

Either Party may terminate this Agreement for convenience upon providing written notice to the other Party no fewer than days prior to termination. Termination for material breach is effective upon written notice if the breaching Party fails to cure the breach within 30 days after receipt of written notice specifying the breach.

CONFIDENTIALITY

Each Party will hold in confidence and will not disclose to any third party Confidential Information of the other Party except as required by law or as necessary to perform under this Agreement. "Confidential Information" includes business information, device security configurations, access credentials, and any nonpublic technical or financial information disclosed in connection with this Agreement.

Obligations of confidentiality survive termination for a period of years. Upon termination, each Party will, at the disclosing Party's option, promptly return or certify destruction of Confidential Information.

Client acknowledges that Provider may implement remote device management, security software, or access controls as a condition of permitting CYOD devices to connect to Provider systems. Client grants Provider limited rights to access or manage the Device solely to enforce security policies and provide support.

NOTICES

Client Notice Address Provider Notice Address

GOVERNING LAW

This Agreement will be governed by and construed in accordance with the laws of the State of , without regard to conflict of laws principles. The Parties submit to the exclusive jurisdiction of the state and federal courts located in that State for disputes.

INDEMNIFICATION

Each Party will indemnify and hold harmless the other Party from and against any third-party claims arising out of its negligence, willful misconduct, or breach of this Agreement. Client is responsible for loss or damage to Client-owned Devices except to the extent caused by Provider's gross negligence or willful misconduct.

ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether written or oral. Any amendment to this Agreement must be in writing and signed by authorized representatives of both Parties.

ACKNOWLEDGEMENTS

Client acknowledges that use of CYOD devices may require installation of security software, periodic updates, and compliance with Provider policies. Client agrees to comply with such requirements and to notify Provider promptly of any loss, theft or compromise of a Device.

Client confirms acceptance of the terms above: I acknowledge and agree

Client:

By:

Date:

Provider:

By:

Date:

What a Client CYOD Agreement Covers

Client CYOD Agreement is a legally binding contract that sets terms for permitting a client or contractor to use a personally owned device to access an organization’s systems, data, and services. It defines permitted device types, minimum security controls, acceptable use rules, responsibilities for data protection, and procedures for onboarding and offboarding devices. The agreement also allocates liability for loss or breach, specifies reporting requirements for incidents, and describes remediation measures and device-wipe options to protect proprietary and regulated information.

Why a CYOD Agreement Matters for Risk and Compliance

Use a Client CYOD Agreement to reduce security risk while enabling convenient device access, clarify responsibilities for data handling, and create enforceable rules for incident reporting and remediation. It helps align expectations between the client and organization and supports regulatory compliance.

Who Typically Completes or Signs a CYOD Agreement

Organizations and clients use this agreement when personal devices require access to corporate systems, sensitive data, or regulated applications.

IT administrators and security teams who must control device access and enforce policies.
Contractors and consultants accessing client systems from personal phones or laptops.
Small business owners and independent professionals needing remote access to client platforms.

Select signers who have authority to commit the party to security obligations and ensure copies are retained by IT and legal for audit purposes.

Primary Roles Responsible for CYOD Compliance

IT Manager

As the technical owner, the IT Manager reviews device compliance, applies configuration baselines, coordinates remote wipe procedures, approves onboarding, and documents security incidents. They act as primary contact for audits and ensure policies conform to applicable laws like HIPAA or state privacy statutes.

Client Representative

The client representative signs the CYOD Agreement, confirms device ownership and acceptable use, reports incidents promptly, and follows organizational directives for security updates and data handling. Their acknowledgement establishes consent to electronic records and authorized remote management.

Core Components to Include in the Agreement

Key elements of a Client CYOD Agreement define responsibilities, technical requirements, and lifecycle actions from onboarding to device decommissioning securely.

Scope

Defines who may use personal devices, permitted systems and data categories, exclusions for sensitive applications, and functional limits such as VPN-only access or prohibition on storing regulated data locally.

Security Requirements

Specifies minimum controls: device encryption, screen lock, OS patching, approved antivirus, secure configuration baselines, and mandatory multi-factor authentication where required.

Access Rights

Describes network and application access levels, role-based permissions, session timeouts, and rules for shared accounts or administrative privileges on client devices.

Incident Reporting

Requires prompt reporting of lost/stolen devices, suspected compromise, and outlines notification timelines, escalation path, and cooperating with forensic or remediation actions.

Liability

Allocates responsibility for data loss, breach notification costs, and indemnification scope; clarifies whether client or organization bears cost of remediation and regulatory fines.

Termination

Specifies offboarding procedures, data removal or remote wipe authority, return of credentials, and continuing obligations such as confidentiality post-termination.

Step-by-Step: How to Complete and Execute the Agreement

Follow these sequential steps to complete and execute the Client CYOD Agreement accurately, whether on paper or electronically.

01

Prepare Parties: Enter full legal names and contact details.
02

Define Devices: List permitted devices and identifiers.
03

Specify Controls: State required security settings and authentication.
04

Sign & Date: All authorized signers must sign and date.

How to Configure the Agreement for Online Signing

Configure the online workflow to match legal and operational needs before sending the Client CYOD Agreement for signatures.

Workflow setting and online configuration	Configuration
Template selection and variable placeholders	Use a standardized template with variable placeholders.
Required field enforcement and validation	Mark name, date, and signature fields as required.
Signer authentication method and strength	Choose email link, SMS code, KBA, or SSO.
Conditional visibility and logic rules	Show device details only when BYOD is selected.

Technical Requirements for Digital Signing and Storage

Digital signatures and eSubmission require compatibility with your identity verification and file formats; configure integrations and authentication before sending.

Integrations: Salesforce, NetSuite, Google Workspace, Microsoft 365
File Formats: PDF, DOCX, HTML, XLSX supported
Auth Options: Email, SMS, KBA, or SSO available

Where to Send and File the Executed Agreement

Typical routing for an executed Client CYOD Agreement includes internal IT, legal, and the client signatory with stored copies for audit and compliance.

Send to IT: Attach to asset inventory and device management system.
Send to Legal: Record in contract repository for legal review.
Provide to Client: Deliver signed copy and retention policy summary.
Archive: Store final PDF with audit trail for retention.

Timelines, Deadlines, and Processing Expectations

Key deadlines and processing expectations for the Client CYOD Agreement ensure timely onboarding, security checks, and regulatory compliance.

Signing Deadline:

Complete signing before device enrollment or first access.

Onboarding Window:

Device must pass security checks within five business days.

Incident Reporting Timeframe:

Report loss or compromise within 24–72 hours.

Periodic Review:

Annual policy and device inventory review recommended.

Retention Trigger:

Retention begins on effective date; see retention schedule.

Key Milestones from Request to Offboarding

Milestone sequence from request to device retirement clarifies responsibilities and time expectations during the device lifecycle.

01

Request Submission

Client submits device details and consent forms.

02

Security Assessment

IT validates controls and approves access levels.

03

Enrollment & Provisioning

Device added to MDM, certificates issued, access enabled.

04

Offboarding & Wipe

Revoke access, remove credentials, and perform remote wipe.

Common Mistakes to Avoid When Preparing the Agreement

Failing to record accurate device identifiers leads to inability to trace a compromised device and may prevent targeted remote wipe or forensics.
Using vague or overly broad access descriptions lets apps request unnecessary permissions and can expose sensitive systems without adequate controls or least-privilege enforcement.
Omitting explicit remote-wipe consent creates civil liberty concerns and operational disputes when personal data will be erased during remediation steps.
Failing to require current OS patches and automated updates increases exploit risk; manual update policies are often inconsistently followed.

Penalties and Risks of an Incorrect or Missing Agreement

Regulatory Fines: HIPAA fines and enforcement exposure

Breach Costs: Notification, remediation, legal defense costs

Contract Termination: Client may terminate services for noncompliance

Liability Exposure: Indemnity claims and damage recovery risk

Operational Disruption: Loss of access and productivity during incidents

Reputational Harm: Erosion of client trust and lost opportunities

How a Client CYOD Agreement Compares to a BYOD Policy

A quick comparison shows where a signed agreement adds enforceability compared with an internal BYOD policy or informal acknowledgement.

Comparison criteria across document types	Client CYOD Agreement	BYOD Policy
Legal enforceability		policy acknowledgment
Scope	device access and controls	organizational expectations
Signature required	yes, signature required	usually no signature
Enforcement mechanism	contract remedies	internal disciplinary actions

eSignature Vendor Pricing Comparison for Executing CYOD Agreements

Pricing and feature comparison for common eSignature vendors when used to execute a Client CYOD Agreement or similar security addenda.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial, no credit card required	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

How to Download, Save, and Package Executed Agreements

When executing and storing the Client CYOD Agreement, choose appropriate formats and include companion documents for audit and compliance.

Download Formats

Save final executed copy as PDF/A for long-term preservation and compatibility with audit requirements; retain the native DOCX for future edits.

Supporting Docs

Attach asset inventories, device receipts, proof of ownership, and any security attestation forms that corroborate the device details and controls.

Audit Trail

Include the complete audit trail showing signer identity, timestamps, IP addresses, and authentication method to support enforceability.

Export Options

Export to cloud storage or archive systems in PDF with embedded audit metadata; include checksum or hash for integrity.

Practical Examples of CYOD Agreements in Use

Real-world examples show how organizations adapt CYOD agreements to sector needs while using eSignature platforms for compliance and speed.

Martin Properties

Martin Properties required client-owned device controls for remote leasing operations to avoid in-person paperwork and speed transactions.

Used signed agreements for device access at lease signing.
I can process and execute all of these documents online with 100% compliance and built-in security. Whether on mobile or working offline, I can get forms back to their necessary parties efficiently.

Healthcare Practice

Healthcare providers must balance patient privacy with remote access; CYOD agreements clarify device handling and HIPAA responsibilities for clinicians using personal devices.

Signed consents plus device controls secure PHI access.
The organization implemented encryption, restricted local storage, and logging to ensure clinicians could comply with HIPAA while using personal devices.

How to Update or Amend an Existing CYOD Agreement

Use the following grid to amend a Client CYOD Agreement through documented revisions and version control.

01

Draft Amendment:

Describe changes clearly and reference original clause.

02

Internal Review:

Legal and IT review proposed language.

03

Client Approval:

Obtain client signature for any material change.

04

Version Control:

Assign version number and effective date.

05

Communicate Change:

Notify affected users and update policies.

06

Archive Prior Version:

Keep previous executed versions per retention policy.

Practical Tips to Improve Accuracy and Efficiency

Practical tips to improve accuracy, enforceability, and operational efficiency when using Client CYOD Agreements across teams.

Standardize templates and clauses

Use a consistent template reviewed by legal to reduce review time and ensure compliance. Include clear definitions, minimal optional language, and pre-approved security controls to streamline onboarding.

Define minimal acceptable controls

Set clear technical baselines—encryption, passcode policies, auto-updates, and MFA—so that IT can enforce compliance programmatically and reduce subjective exceptions.

Use eSignature with audit trail

Capture signer identity, timestamps, IP addresses, and authentication method. Store the signed PDF with embedded audit metadata to meet ESIGN/UETA record reproduction requirements and support legal challenges.

Periodic auditing and enforcement

Schedule regular audits of enrolled devices, patch status, and compliance logs. Enforce noncompliance with remediation plans and ensure offboarding includes credential revocation and data removal.

Frequently Asked Questions About Client CYOD Agreements

Answers to frequent questions about executing, modifying, and enforcing a Client CYOD Agreement, including eSignature and retention concerns.

Need help? Contact support

Can this be signed electronically?
Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws where adopted. Ensure the four ESIGN criteria—intent, consent, attribution, and reproducible record—are satisfied; consumer-facing records need ESIGN disclosures.
Is notarization required for the agreement?
Not typically. Standard contracts rarely require notarization, though some states permit or require Remote Online Notarization for specific document types. Verify state notary rules and preserve RON session records and notarization journals where used.
What should I do if a device is lost or stolen?
Follow the agreement's incident steps: notify IT immediately, document the incident, attempt remote lock or wipe if authorized, and escalate to legal if PHI or regulated data may be involved. Adhere to internal reporting timelines such as 24–72 hours.
Can the organization remotely wipe my personal device?
Only if the agreement includes explicit, informed consent for remote wipe. The agreement should limit scope, require notice where possible, and describe recovery options for personal data to balance privacy and security.
How long must we keep executed agreements?
Retain the executed agreement for the active term plus applicable statutory periods. For financial records follow IRS rules (IRC §6501(a)), and for healthcare retain related records six years per 45 CFR §164.530(j); state rules may extend these periods.
Are e-signatures admissible in court?
Yes. Courts accept electronic signatures when ESIGN/UETA criteria are met. Preserve the full audit trail, authentication evidence, and exact signed record to support admissibility and rebut challenges to validity.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now