What if I lose my MFA device?

Report the loss to IT immediately and use recorded recovery options (backup code, alternate device, or admin reset). Document the action and date in the MFA record to preserve the audit trail.

Is an electronic signature valid for this form?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, electronic signatures are legally equivalent to handwritten signatures for most transactions, provided intent and retention criteria are met.

Do employees have to accept SMS authentication?

Obtain explicit consent when selecting SMS. Note that SMS is less secure than authenticator apps or security keys and should be designated as fallback rather than the primary method.

How long must we keep signed MFA records?

Retention varies: retain records for the employment term plus company-specified post-termination period. Follow regulatory minima such as IRS (IRC §6501(a)) and HIPAA (45 CFR §164.530(j)) where applicable.

When is notarization required?

Notarization is rarely required for routine MFA enrollment. If a jurisdiction or specific legal instrument requires notarization or witness attestations, follow state rules and preserve the notarized record.

Who can revoke or change authentication methods?

Authorized HR or IT personnel should follow formal revocation procedures and document changes in the MFA record, including the reason and effective date, to maintain an accurate audit trail.

Electronic Signature
Templates
HR
HR MFA Document

HR MFA Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HR MFA DOCUMENT

Employer Name: Location/Office:

Personal Information

Full Legal Name Employee ID Address

Phone

Email

Position Information

Job Title Department

Reporting Manager: Proposed Start Date:

Base Salary / Compensation

Employment History (most recent first)

Employer 1 — Company Name

Primary Responsibilities Reason for Leaving

Employer 2 — Company Name

Primary Responsibilities Reason for Leaving

Education

Highest Degree Institution Graduation Date

Professional References

Reference 1 — Name

Reference 2 — Name

Reference 3 — Name

Multi-Factor Authentication (MFA) Enrollment

Purpose: The Employer requires enrollment in Multi-Factor Authentication for access to all HR systems, payroll, benefits, and sensitive personnel records. Enrollment binds the employee to the security, device, and privacy obligations set out below.

Primary Authentication Method (select at least one)

Authenticator App (company or personal device)
SMS to mobile phone
Hardware Security Key (FIDO2/USB)
Biometric device tied to employer-managed endpoint

Device Details

Backup Methods: Employees must configure at least one backup method (alternate device, backup codes, or hardware key). Backup codes must be stored securely and not shared.

Backup Method Selected

Security Responsibilities & Privacy

Employee Responsibilities: Employee must (1) maintain possession and control of registered devices; (2) promptly report lost/stolen devices to IT and HR; (3) use employer-provided or approved methods for authentication; (4) not share authentication credentials or backup codes; (5) promptly complete any mandated re-registration.

Privacy and Data Handling: Authentication logs, device identifiers, and metadata may be collected and retained to protect systems and to comply with legal obligations. Such data will be used consistent with the Employer's data protection policies and only for security, compliance, and investigative purposes.

Lost Device, Exceptions, and Remediation

Lost or Stolen Devices: Employee must immediately notify IT Support and HR. Temporary access may be granted following identity verification and re-enrollment. Repeated failure to secure devices may result in suspension of access or disciplinary action up to termination.

Request for Exception (if applicable)

Legal Disclosures

At-Will Employment: Nothing in this document alters the at-will nature of employment. Either the Employer or the Employee may terminate the employment relationship at any time, with or without cause, subject to applicable law.

Equal Employment Opportunity: The Employer maintains an equal opportunity policy. Enrollment in MFA and enforcement of security policies will be applied uniformly and without unlawful discrimination.

Background Check Authorization & Applicant Certification

Authorization: I authorize the Employer and its agents to contact my previous employers, educational institutions, and references for verification and background screening related to my employment. I understand that information obtained may be used for employment decisions.

Consent to Background Check

I consent to background checks and verification as described above.

Applicant Certification: I certify that all information supplied on this form is true and complete to the best of my knowledge. I understand that falsification, omission, or misrepresentation may disqualify me from employment or be grounds for discipline or termination.

Employee Attestation (check all that apply)

I have read and understand the MFA enrollment and security responsibilities set forth in this document. I accept responsibility for maintaining meaningful control over registered authentication devices. I understand non-compliance may result in access suspension or disciplinary measures.

Acknowledgement and Signature

By signing below, I acknowledge that I have reviewed this HR MFA Document, agree to enroll in the selected MFA methods, authorize communications necessary to validate my identity and previous employment, and accept the responsibilities and consequences described herein.

Employee Name:

Signature:

Date:

What the HR MFA Document Is

The HR MFA Document records an employee's multi-factor authentication (MFA) enrollment, chosen authentication methods, and consent for employer-managed access controls. It documents identity proofing, device assignment, backup and recovery options, and the effective date for security controls. The form creates an auditable record of the company’s MFA policy application to a specific employee account and supports compliance with internal IT, HR, and privacy processes.

Why an HR MFA Document Matters

A completed HR MFA Document helps reduce unauthorized access, preserves an auditable consent trail, and clarifies responsibilities for device management and recovery. It supports compliance with electronic record laws and internal security policies.

Who completes and relies on this document

Typical users, approvers, and downstream reviewers are listed below.

HR administrators and onboarding specialists responsible for collecting employee consent and enrollment data.
IT or security teams that provision MFA devices, verify identity proofing, and manage authentication settings.
Supervisors or department managers who confirm role-based access needs and sign approvals when elevated privileges are granted.

Use these role distinctions to route the form correctly and store the signed record where HR and IT both can retrieve it.

Core components to include in a professional HR MFA Document

Include clear sections that capture identity, chosen authentication methods, consent language, device details, recovery options, and signature blocks. A consistent structure avoids ambiguity during audits and when reassigning or deprovisioning accounts.

Identity

Employee legal name, company ID, job title, and department to uniquely identify the account holder.

Authentication Methods

List primary and fallback methods (TOTP app, hardware security key, SMS, phone call), and note any restrictions.

Device Details

Record device make/model, serial or token ID, and assigned asset tag when employer-owned hardware is used.

Consent & Acknowledgement

Clear language showing employee consents to employer authentication processes and any monitoring or management actions.

Recovery Options

Specify recovery methods (backup codes, alternate device, admin reset) and the responsible party for recovery actions.

Signature & Date

Signed employee and authorizing manager signatures with effective date and printed names for auditability.

Step-by-step: completing the HR MFA Document

Follow these sequential steps to enroll an employee and create an auditable record that IT and HR can reference.

01

Prepare: Collect identity documents and HRIS data before starting enrollment.
02

Verify: Validate identity and confirm Employee ID and department.
03

Select Methods: Record chosen MFA methods and any employer-assigned devices.
04

Sign & Record: Obtain signatures, record effective date, and store the signed file in HR and IT archives.

How enrollment and eSubmission typically flow

A clear digital workflow minimizes friction while preserving audit data. The following sequence describes a typical eSubmission process.

Upload Form: HR uploads the completed PDF or DOCX to the signing platform.
Assign Signers: Add employee and required approvers in the correct signing order.
Authenticate: Signers confirm identity via email link, SMS code, or stronger KBA when required.
Complete Record: Signed document and audit trail are saved and routed to HR and IT repositories.

Recommended digital workflow settings

Standardize the signing and provisioning workflow to ensure consistent identity verification, retention of audit data, and secure storage.

Field	Configuration
Authentication Method	TOTP app, security key, SMS fallback
Identity Proofing	ID check and HR verification step
Enrollment Flow	Self-service with HR/IT approval gate
Audit Trail	Capture IP, timestamp, and signer attribution

Platform and file-format considerations

Choose a signing platform that supports secure audit trails, common file formats, and integrations with HR/IT systems.

File Types: PDF, DOCX, HTML, and Excel supported
Integrations: Salesforce, Microsoft 365, NetSuite, Google Workspace
Authentication: Email, SMS, KBA, and advanced MFA options

Security and compliance checklist

Encryption in transit: TLS 1.2 / 1.3

Encryption at rest: AES-256 encrypted storage

Audit logging: Immutable timestamps and IPs

Compliance standards: SOC 2 Type II, ISO 27001

Healthcare controls: HIPAA support with BAA

Regulated signatures: 21 CFR Part 11 compliance

eSignature vendor comparison for HR MFA Document workflows

Comparison of starting prices, trial availability, bulk send, audit trail, HIPAA support, and envelope caps. Use this as a quick reference when evaluating providers for HR workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial (no card)	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year limit	Varies	Varies	Varies

Common mistakes when preparing an HR MFA Document

Entering a personal phone number without explicit SMS consent can trigger privacy complaints and complicate later audits if company-managed authentication is required.
Recording mismatched names or Employee IDs prevents smooth reconciliation with HRIS and can delay provisioning or deprovisioning during an audit or termination.
Relying solely on SMS as the primary MFA method increases security risk; SMS is susceptible to SIM swap attacks and is discouraged for high-privilege accounts.
Failing to document recovery procedures or backup codes can create long help-desk delays when employees lose access to their primary device.

Penalties and operational risks of incomplete or incorrect records

Unauthorized access: Increased breach risk and lateral movement

Compliance fines: Potential HIPAA or sector fines where applicable

I-9 paperwork fines: $281–$2,789 per violation (8 CFR)

Operational downtime: Employee lockouts slow business operations

Reputational harm: Publicized breaches reduce stakeholder trust

Audit findings: Record gaps trigger remediation costs

Practical tips for accurate, efficient completion

Adopt consistent templates, prefer phishing-resistant authentication, and keep records centralized and auditable to reduce friction and cyber risk.

Prefer strong authenticators

Use authenticator apps or hardware security keys for primary MFA, limiting SMS to fallback roles. Hardware keys provide phishing-resistant authentication suitable for privileged accounts.

Document recovery steps

Record backup codes, alternate device details, and an escalation path. Clear recovery procedures reduce help-desk load and maintain business continuity during lockouts.

Maintain an audit trail

Capture timestamps, IP addresses, and identity-proofing evidence for each enrollment event. Retain the audit trail per your retention policy to support compliance reviews.

Coordinate HR and IT

Define ownership for enrollment, deprovisioning, and periodic revalidation. Cross-functional procedures prevent orphaned accounts and reduce insider risk.

Real-world examples of MFA records in use

Two brief examples show how organizations document MFA enrollment and manage associated processes.

Martin Properties — Tim Martin, Founder

Tim Martin standardized enrollment forms to capture device serials and employee consent at hire

Added TOTP app as default with SMS fallback
The policy reduced on-site provisioning delays and created a single source of truth for property managers and IT during off-cycle access requests.

Fertility Centers of Illinois — John Butler, Founder

Fertility Centers attached consent language and recovery options to each MFA record

Implemented BAA-covered storage for sensitive staff records
This ensured HIPAA-conscious handling of authentication records and simplified audits by keeping HR and IT records aligned.

Frequently asked questions about the HR MFA Document

Answers to common issues encountered when filling, signing, or managing HR MFA Documents in a U.S. enterprise environment.

Need help? Contact support

What if I lose my MFA device?
Report the loss to IT immediately and use recorded recovery options (backup code, alternate device, or admin reset). Document the action and date in the MFA record to preserve the audit trail.
Is an electronic signature valid for this form?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, electronic signatures are legally equivalent to handwritten signatures for most transactions, provided intent and retention criteria are met.
Do employees have to accept SMS authentication?
Obtain explicit consent when selecting SMS. Note that SMS is less secure than authenticator apps or security keys and should be designated as fallback rather than the primary method.
How long must we keep signed MFA records?
Retention varies: retain records for the employment term plus company-specified post-termination period. Follow regulatory minima such as IRS (IRC §6501(a)) and HIPAA (45 CFR §164.530(j)) where applicable.
When is notarization required?
Notarization is rarely required for routine MFA enrollment. If a jurisdiction or specific legal instrument requires notarization or witness attestations, follow state rules and preserve the notarized record.
Who can revoke or change authentication methods?
Authorized HR or IT personnel should follow formal revocation procedures and document changes in the MFA record, including the reason and effective date, to maintain an accurate audit trail.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now