Scope
Define which systems, email domains, user groups, and message types are covered, and whether attachments, links, or inline data are included in scope for security controls.
A written Email Security Agreement provides legal clarity about encryption, retention, breach notification, and responsibilities, helping organizations meet regulatory obligations and reduce technical and compliance risk.
Use the agreement to document consent, specify controls, and assign responsibilities so all parties understand expected security practices and compliance obligations.
Define which systems, email domains, user groups, and message types are covered, and whether attachments, links, or inline data are included in scope for security controls.
Specify acceptable encryption in transit (TLS 1.2/1.3) and at rest (AES-256), any mandatory S/MIME or PGP use, and minimum cipher suites permitted for message exchange.
Describe sender and recipient authentication: required DKIM/SPF/DMARC configuration, multi-factor authentication for administrative access, and identity-proofing steps for third parties.
Set timelines for reporting suspected compromises, the responsible contacts, required forensic evidence preservation, and cooperation obligations during remediation and notification.
Outline permitted data categories, classification labels, retention rules, deletion processes, and requirements for secure archival or encrypted backup of messages containing regulated data.
Allocate responsibility for breaches, caps on damages if applicable, indemnification language, and the procedure for resolving disputes or claims related to email security failures.
| Field | Configuration |
|---|---|
| Access Control | Restrict editing to legal and security roles |
| Required Approvals | Parallel approval from security and legal |
| Audit Trail | Capture timestamps, IP, and action logs |
| Retention | Export signed copy to secure archive |
Document platform responsibilities clearly so procurement and IT teams can validate configuration and maintain audit capabilities after execution.
Allow 10–30 days for technical and legal review before signing.
Specify 30–90 days for required controls deployment after signature.
Require initial notification within 72 hours or as agreed contractually.
Schedule annual or biennial compliance assessments.
Retention measured from effective date or last active transaction.
Create the initial agreement and technical annex for review.
Legal and security teams exchange redlines and agree on controls.
Authorized signatories sign and effective date is established.
Implement monitoring, audits, and periodic renewals.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |