Is an eSignature legally valid for this exhibit?

Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in nearly all states, provided intent, consent, attribution, and retention requirements are met.

When is a BAA required?

A Business Associate Agreement is required when the vendor handles protected health information; include HIPAA-specific language and ensure the vendor will sign a BAA before PHI is exchanged.

What to do if a certificate is expired?

Request an updated attestation or corrective action plan. Expired certificates should be treated as nonconforming evidence until replaced or validated by additional proof.

How to authenticate the signer adequately?

Use multi-factor authentication (email plus SMS or KBA) for higher assurance; stronger methods reduce dispute risk in high-value or regulated transactions.

Do I need a notary or witness?

Not typically required for cybersecurity exhibits; state or contract-specific requirements may demand notarization or witnesses for related documents such as deeds or powers of attorney.

What if an incident occurs after execution?

Follow the exhibit’s incident response and notification clauses, preserving forensic evidence and notifying partners within the specified timeframe; failure to follow contract terms can trigger remedies.

Electronic Signature
Templates
Miscellaneous
Cybersecurity Compliance Exhibit

Cybersecurity Compliance Exhibit

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CYBERSECURITY COMPLIANCE EXHIBIT

This Cybersecurity Compliance Exhibit ("Exhibit") is incorporated into and made part of the Master Agreement between Client Name: and Contractor Name: . Effective Date: / / .

WHEREAS

WHEREAS, the parties have entered into the Master Agreement referenced above and require supplemental cybersecurity obligations to protect Confidential Information and operational systems; and

WHEREAS, Contractor will provide goods and/or services that involve access to Client systems, data, or networks and Contractor shall implement, maintain and demonstrate compliance with the security controls and processes set forth in this Exhibit; and

WHEREAS, this Exhibit sets forth minimum cybersecurity requirements, reporting obligations, and remediation timelines that Contractor must meet as a condition of performing under the Agreement.

SCOPE OF WORK

Description of services and security deliverables

SECURITY CONTROLS & STANDARDS

Contractor shall establish, document, maintain and demonstrate the following baseline controls for all Covered Systems used to perform under the Agreement:

- Encryption of data at rest and in transit where feasible: - Multi-factor authentication for privileged access: - Timely patch management per vendor guidance: - Logging, retention and secure storage of security events: - Principle of least privilege enforced for accounts and services:

Contractor shall maintain written policies implementing the above controls and shall make such policies and related evidence available to Client in accordance with the Audit and Assessment section below.

INCIDENT RESPONSE AND NOTIFICATION

Contractor shall notify Client of any Security Incident affecting Client Data or Client Systems within hours of discovery and shall provide initial written notice within the same period. Final incident reports shall be delivered no later than days after containment.

Primary incident contact for Contractor

THIRD-PARTY ASSESSMENTS & AUDITS

Contractor shall permit Client, or an independent third-party auditor engaged by Client, to conduct reasonable security assessments and audits of Contractor's applicable systems and policies, not more frequently than months, except where a material security incident justifies immediate review. Contractor shall remediate findings according to the Remediation and Corrective Action section below.

Vulnerability scanning and penetration testing schedule

REMEDIATION AND CORRECTIVE ACTION

Contractor shall remediate validated critical vulnerabilities within calendar days and high vulnerabilities within calendar days of identification, unless an agreed written exception is granted by Client.

PAYMENT TERMS

Compliance fee amount Payment schedule and milestones

Late payments shall accrue interest at on the outstanding balance, or the maximum rate permitted by law, whichever is lower. Contractor shall submit invoices to:

Invoice remit-to address

TERM AND TERMINATION

This Exhibit shall commence on Start Date: / / and shall continue until End Date: / / unless earlier terminated in accordance with this Exhibit or the Master Agreement.

Either party may terminate this Exhibit for convenience upon written notice of days to the other party. Either party may terminate for material breach if the breaching party fails to cure within days after written notice specifying the breach.

CONFIDENTIALITY

As used in this Exhibit, "Confidential Information" includes Client Data, security designs, vulnerability findings, incident reports, and any other information designated as confidential in the Master Agreement. Contractor shall protect Confidential Information using administrative, technical and physical safeguards at least as protective as those the Contractor uses to protect its own similar information, and in no event less than reasonable care.

Contractor shall not disclose Confidential Information except to those of its employees, contractors or agents who have a need to know and are bound by obligations of confidentiality no less restrictive than those set forth herein. Contractor shall promptly notify Client in writing of any unauthorized access, use or disclosure of Confidential Information.

GOVERNING LAW

This Exhibit and any dispute arising out of or related to it shall be governed by the laws of the State of without regard to its conflict of laws principles.

ENTIRE AGREEMENT

This Exhibit, together with the Master Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings and agreements, whether written or oral, relating to such subject matter. In the event of any conflict between the terms of this Exhibit and the Master Agreement, the more restrictive security obligation shall prevail.

ATTESTATION

By signing below, Contractor certifies that, as of the Effective Date, Contractor has implemented the controls and processes described in this Exhibit and will maintain them throughout the term. Contractor further certifies that all information provided to Client regarding security posture is true, complete and not misleading.

Contractor attestation:

Client Printed Name:

Client Title:

Client Signature:

Date:

Contractor Printed Name:

Contractor Title:

Contractor Signature:

Date:

What the Cybersecurity Compliance Exhibit Is

A Cybersecurity Compliance Exhibit is a contract exhibit attached to a commercial agreement that documents the cybersecurity obligations between parties. It defines scope, minimum technical and administrative controls, reporting and notification obligations, audit and remediation rights, and acceptable evidence such as certifications or third‑party assessments. The exhibit creates an auditable record of requirements for vendors, service providers, and customers and is commonly used where data protection, regulated data, or critical infrastructure services are involved.

Why include a Cybersecurity Compliance Exhibit

The exhibit clarifies responsibilities, reduces ambiguity about security expectations, and provides contractual remedies if obligations are unmet. It supports regulatory compliance, helps manage third‑party risk, and documents evidence useful for audits and incident response.

Who typically prepares and signs the exhibit

Multiple internal teams and external providers interact with this exhibit; roles should be identified up front.

Legal and contracts teams: Draft and approve exhibit language, manage indemnity and liability clauses, and review governing law provisions.
Information security teams: Specify technical controls, monitoring requirements, and evidence types such as SOC 2 or ISO 27001.
Procurement and vendor risk managers: Evaluate vendor responses, collect attestations, and coordinate remediation timelines.

Define a single point of contact and authority for execution to reduce delays and ensure traceability.

Essential components to include in a professional exhibit

A complete exhibit combines governance, technical requirements, proof obligations, and response processes so contracts are actionable and auditable.

Scope

Define in-scope systems, data types (PHI, PII, payment card), environments, and whether subcontractors are covered; clarity avoids downstream disputes and narrows audit targets.

Minimum Controls

List specific controls (access control, encryption, patch management, logging, MFA) with measurable baselines and exceptions handling to guide compliance assessments.

Incident Response

Specify notification timelines, required content of breach notices, coordination obligations, and forensic evidence preservation to align legal and operational responses.

Audit and Assessment

Include audit rights, frequency, acceptable evidence (SOC 2 report, ISO certificate, penetration test report), and remediation timeframes for nonconformities.

Data Handling

State encryption requirements in transit and at rest, data retention limits, segregation, and permitted processing to meet regulatory expectations.

Remedies

Describe contractual remedies, indemnities, termination rights, and support obligations that apply if the vendor fails to meet specified cybersecurity requirements.

Required information fields at a glance

Party legal name: Full registered entity

Primary contact: Name, role, email

Systems covered: Short environment list

Control baseline: Named framework(s)

Certifications: SOC 2, ISO, etc.

Exhibit effective date: MM/DD/YYYY

Step-by-step: completing the Cybersecurity Compliance Exhibit

Follow a short, consistent workflow to prepare, validate, and execute the exhibit with required evidence attached.

01

Gather evidence: Collect policies, reports, and certificates before drafting.
02

Populate exhibit: Enter scope, controls, and contacts accurately.
03

Review internally: Legal and security teams validate content.
04

Execute and attach: Sign, timestamp, and store signed exhibit with evidence.

Configuring an online workflow for this exhibit

Use a repeatable digital workflow to collect signatures, authenticate signers, and attach supporting evidence in a single transaction.

Field	Configuration
Signature Method	eSignature (ESIGN/UETA compliant)
Authentication	Email link plus optional SMS code
Retention	Store PDF/A with audit trail
Integrations	SIEM, GRC, and document repositories

Digital signing and distribution considerations

Choose a signing platform that preserves an immutable audit trail, supports required authentication, and stores attachments securely.

Formats supported: PDF, DOCX, and archival PDF/A
Integrations: Connectors for GRC and cloud storage
Authentication options: Email link, SMS code, KBA

Ensure the chosen platform supports required evidence retention, secure storage (AES-256 at rest, TLS 1.2/1.3 in transit), and the ability to export a signed certificate of completion for audit purposes.

Routing the exhibit: who receives it and when

A typical distribution route minimizes signer friction while meeting authentication and compliance needs.

Upload exhibit: Attach exhibit and supporting evidence.
Assign roles: Designate signers and reviewers in order.
Authenticate signer: Use email link or stronger method.
Sign and archive: Capture signature, timestamp, and audit trail.

Key timing rules and reporting windows

Define deadlines for attestations, audits, and incident notifications to align contract obligations with internal processes and regulatory timeframes.

Exhibit effective date:

Controls apply from the date entered in the exhibit.

Quarterly attestations:

Vendors often provide quarterly control attestations or confirm no material changes.

Annual audit:

Provide an annual SOC 2 or equivalent independent assessment.

Incident reporting:

Notify within 72 hours for major breaches; shorter windows may apply per law.

Retention review:

Review attached evidence annually for currency and expiration.

Milestones from negotiation to ongoing compliance

Track milestone stages to ensure the exhibit is negotiated, executed, and validated on schedule.

01

Draft and scope

Agree in-scope systems and data before contract signature.

02

Evidence collection

Supplier submits certificates and test reports.

03

Execution

Parties sign the exhibit and archive copies.

04

Ongoing monitoring

Periodic attestations and audits verify continued compliance.

Common preparation mistakes to avoid

Vague scope descriptions that fail to list specific systems, environments, or data categories used in production.
Requesting attestations without validating certificate dates or review scope leading to stale or irrelevant evidence.
Relying on image-only signatures or disconnected email threads that lack an auditable proof of intent and attribution.
Poor version control: multiple unsigned exhibit drafts circulated without a single agreed final document.

Consequences of incomplete or incorrect exhibits

Regulatory fines: State and federal penalties may apply

Contract breach: Monetary damages or termination rights

Indemnity exposure: Costly indemnity and defense obligations

Breach notification: Mandatory public notices and remediation costs

Operational disruption: Forced remediation and service downtime

Reputation harm: Customer and partner trust erosion

eSignature vendor comparison for executing the exhibit

Basic vendor attributes relevant to executing and managing a Cybersecurity Compliance Exhibit; signNow appears first per platform comparisons.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Real-world examples of exhibit use

Organizations attach a Cybersecurity Compliance Exhibit to vendor agreements to document controls and evidence in real operations.

Martin Properties — Practical compliance

The property management firm standardized exhibits across vendors to reduce review cycles.

This ensured leases and vendor services referenced the same controls.
The result was faster execution and consistent audit trails for property transactions, with clear evidence for each vendor relationship.

Fertility Centers of Illinois — Healthcare example

A healthcare provider required exhibits with BAAs and explicit PHI handling controls.

The vendor supplied SOC 2 and encryption attestations.
That approach aligned contractual protections with HIPAA obligations and simplified incident coordination between provider and vendor teams.

Frequently asked questions and common issues

Answers to typical questions about execution, evidence, and enforceability for the Cybersecurity Compliance Exhibit.

Need help? Contact support

Is an eSignature legally valid for this exhibit?
Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in nearly all states, provided intent, consent, attribution, and retention requirements are met.
When is a BAA required?
A Business Associate Agreement is required when the vendor handles protected health information; include HIPAA-specific language and ensure the vendor will sign a BAA before PHI is exchanged.
What to do if a certificate is expired?
Request an updated attestation or corrective action plan. Expired certificates should be treated as nonconforming evidence until replaced or validated by additional proof.
How to authenticate the signer adequately?
Use multi-factor authentication (email plus SMS or KBA) for higher assurance; stronger methods reduce dispute risk in high-value or regulated transactions.
Do I need a notary or witness?
Not typically required for cybersecurity exhibits; state or contract-specific requirements may demand notarization or witnesses for related documents such as deeds or powers of attorney.
What if an incident occurs after execution?
Follow the exhibit’s incident response and notification clauses, preserving forensic evidence and notifying partners within the specified timeframe; failure to follow contract terms can trigger remedies.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now