Can this form be e-signed?

Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided intent, consent, attribution, and record retention requirements are met.

Are there exceptions to e-signature validity?

Certain documents remain excluded from electronic execution under law, such as wills and some court orders. Confirm whether the specific authorization or jurisdiction imposes exceptions before relying solely on e-signatures.

Is notarization required?

Not typically for testing authorization forms, but if a signature must be notarized by policy or contract, use in-person notarization or Remote Online Notarization according to the applicable state rules.

How do I protect PHI during testing?

Include HIPAA-compliant data handling clauses, limit scope, require encryption at rest and in transit, and execute a BAA when tests touch protected health information.

What file formats should I accept?

PDF is the standard for signed records. Also accept DOCX where necessary, but ensure the final stored copy is a secured PDF with an attached audit trail.

How do I revoke or cancel authorization?

Document revocation in writing with date and approver. Notify testers immediately, suspend testing access, and retain both the revoked form and the revocation notice for the record.

Electronic Signature
Templates
Miscellaneous
Information Security Testing Form

Information Security Testing Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

INFORMATION SECURITY TESTING FORM

RECITALS

WHEREAS, Client Name: engages Provider Name: to perform authorized information security testing under the terms set forth herein.

WHEREAS, the parties desire to establish the scope, schedule, limitations, and legal protections applicable to such testing beginning on Effective Date: and continuing in accordance with this form.

WHEREAS, Provider represents that it has the skill, experience, and authority to perform the testing in a manner that minimizes risk to systems and data while reasonably identifying security vulnerabilities.

SCOPE OF WORK

Description of Testing Services Testing Methods (select all that apply)

Vulnerability scanning Penetration testing Social engineering (e.g., phishing) Physical security assessment

In-Scope Assets Out-of-Scope Assets Authorized IP Ranges, Domains, and Network Identifiers

RULES OF ENGAGEMENT

Testing Window Start Date: End Date: Testing Hours (local time):

Provider shall avoid intentional destructive testing unless expressly authorized in writing. Provider will follow escalation procedures on discovery of critical vulnerabilities that pose immediate risk to operations.

Escalation Contact — Client Escalation Contact — Provider

PAYMENT TERMS

Total Fee Payment Schedule Late Fee

TERM AND TERMINATION

Term Start Date: Term End Date:

Termination Notice Period (days)

Either party may terminate this authorization for cause upon material breach if the breaching party fails to cure within the notice period above. Termination does not relieve the Client of payment obligations for services already performed.

CONFIDENTIALITY

Provider acknowledges that in the course of testing it may access Confidential Information of Client. Provider agrees to hold such information in strict confidence, to use it solely to perform the authorized testing, and to not disclose it except to its employees or subcontractors who have a need to know and who are bound by confidentiality obligations at least as protective as those herein. Provider will not retain or use Client data for any promotional or non-authorized purpose.

LIABILITY, INSURANCE, AND INDEMNIFICATION

Provider will exercise commercially reasonable care to avoid service disruption. Provider's liability for direct damages arising from negligence or willful misconduct shall be limited to the total fees paid under this authorization for the performed engagement. Neither party shall be liable for consequential, incidental, or punitive damages. Provider shall maintain insurance appropriate to the services and shall provide evidence of coverage upon request.

Provider Insurance Confirmation Provider has provided proof of insurance to Client

DATA HANDLING AND REPORTING

All findings and evidence collected during testing are the property of Client. Provider shall deliver a written report of findings, risk ratings, and remediation recommendations within Report Delivery Days: calendar days following conclusion of testing.

Reporting Deliverables Evidence Retention

ACKNOWLEDGMENTS AND CERTIFICATIONS

By signing below, Client authorizes Provider to conduct the specified security testing on the in-scope assets during the agreed testing window. Client confirms that it has authority to permit testing on those assets and that all affected third-party providers have been notified when required.

I acknowledge and authorize the testing as described above.

GOVERNING LAW; ENTIRE AGREEMENT

This Authorization shall be governed by and construed in accordance with the laws of the State of: without regard to conflict of laws principles. This form, together with any referenced statements of work or attachments incorporated by reference, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings, whether written or oral.

MISCELLANEOUS PROVISIONS

Any amendments to this Authorization must be in writing and executed by authorized representatives of both parties. If any provision is determined to be unenforceable, the remaining provisions shall remain in full force and effect.

Client Name:

By:

Date:

Provider Name:

By:

Date:

What the Information Security Testing Form Is and when you need it

The Information Security Testing Form documents authorization, scope, and rules of engagement for security testing such as vulnerability scanning, penetration testing, and code review. It records the parties involved, systems and data in scope, scheduled windows, permitted methods, data handling and retention, and contact points for incident escalation. The form also captures legal agreements such as nondisclosure terms, liability limits, and approval signatures so that testing proceeds with documented consent and clear boundaries between testers, owners, and third parties.

Why a formal testing authorization matters

A completed Information Security Testing Form reduces legal exposure, clarifies scope to avoid accidental outages, documents consent for controlled testing, and provides an audit trail for compliance and post-test remediation planning.

Typical users and signers of the form

Teams that commonly prepare or sign this form include security operations, IT, legal, compliance officers, and contracted penetration-test vendors.

Security teams and SOC managers — Request and document testing scope, timing, and risk mitigation responsibilities.
IT / system owners — Confirm systems in/out of scope and approve maintenance windows and fallback plans.
Legal and compliance — Approve contractual language, data handling, and confirm regulatory constraints such as HIPAA or finance rules.

Identifying the appropriate signers up front speeds approvals and ensures the form assigns responsibility for approvals, scheduling, and remediation.

Step-by-step completion checklist

Follow these steps in order to prepare, approve, and record an Information Security Testing Form.

01

Draft form: Populate requester, scope, and dates with technical and business contacts.
02

Review controls: Legal and compliance confirm permitted methods and data protections.
03

Approve schedule: System owners sign off on windows and rollback plans.
04

Execute and record: Perform testing, capture results, and attach evidence to the completed form.

How authorization, testing, and reporting flow

This sequence shows the typical routing and outcomes tied to the form during a testing engagement.

Request submission: Requester uploads form and supporting documentation for review.
Approvals: Legal, compliance, and system owners sign in the documented order.
Testing execution: Approved testers run agreed methods within approved windows.
Reporting and closure: Findings are delivered, remediation tracked, and form retained with evidence.

Configuring a digital workflow for the form

Key workflow settings ensure proper routing, authentication, and evidence capture when using eSubmission.

Field	Configuration
Signer order	Sequential or parallel routing based on roles
Authentication	Email link, SMS code, or stronger KBA as required
Attachments	Permit upload of logs, screenshots, and signed reports
Audit trail	Capture timestamps, IP, and actions for every signer

Technical requirements for secure eSubmission

Confirm the platform supports secure file formats, audit trails, and required authentication before collecting signatures.

File formats: PDF, DOCX, and exportable audit logs
Authentication: Email, SMS, or multi-factor options
Integrations: Connectors for ticketing and storage systems

Core elements a professional form should include

A robust Information Security Testing Form balances operational detail with legal protections and clear contact points to reduce risk during testing.

Scope and exclusions

Precise inventory of systems, IP ranges, and data types in scope plus an explicit list of excluded systems to prevent unintended impact.

Approved techniques

Clear list of permitted testing methods and prohibited actions so testers understand acceptable approaches and limits.

Schedule and windows

Defined start/end dates, time zones, and maintenance windows to coordinate with operations and minimize service disruption.

Risk and rollback plan

Documented contingency actions, emergency contacts, and procedures to restore services if testing causes an outage.

Data protection terms

Requirements for handling sensitive data, storage encryption, redaction, and timelines for evidence destruction where applicable.

Signatures and approvals

Designated approvers, titles, and dated signatures that create a clear authorization trail for auditors and stakeholders.

Essential data elements to collect

Requester Contact: Name, title, email

System Identifiers: IP, hostname, URL

Test Types: Vulnerability scan, pen test

Time Window: Start/end date

Data Sensitivity: PHI, PCI, PII

Signatures: Approver name and date

Common preparation mistakes to avoid

Vague scope statements that omit IP ranges or system identifiers, which can lead to accidental testing of production systems outside authorization.
Failing to include incident contact details and rollback plans, leaving operations unable to respond quickly to a test-caused outage.
Using informal approval channels without dated signatures, resulting in weak audit evidence and possible non-compliance with internal policies.
Ignoring regulatory controls for protected data (for example, PHI under HIPAA), which can lead to reporting obligations and increased liability.

Risks and potential penalties from improper testing

Service disruption: Operational outages

Data exposure: Unauthorized disclosure

Regulatory fines: HIPAA or PCI breaches

Contract breaches: Vendor or customer claims

Legal action: Civil liability

Reputational harm: Loss of trust

Timing expectations and processing steps

Set internal SLAs for review, approvals, testing, and report delivery to keep the engagement on schedule and maintain evidence for compliance.

Request submission timeframe:

Submit 5–10 business days before planned testing

Approval window:

Allow 48–72 hours for legal and owner approvals

Test execution:

Execute during approved window only

Report delivery:

Draft report within 7–14 days after testing

Remediation verification:

Verify fixes within 30 days or per SLA

Key milestones from request to closure

Track these numbered milestones to ensure visibility and traceability throughout the testing lifecycle.

01

1. Request filed

Form submitted and initial scope recorded for review.

02

2. Approvals obtained

Legal, compliance, and owners sign off on scope and methods.

03

3. Testing performed

Authorized tests executed during approved windows with monitoring.

04

4. Reporting and close

Findings delivered, remediation tracked, and evidence archived.

Selected eSignature vendor pricing and feature snapshot

Compare common pricing points and basic feature availability for eSignature providers used to collect signed testing authorizations.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (Business Premium)	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA required)	Varies by plan	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about the Information Security Testing Form

Answers to typical issues encountered when preparing, authorizing, and submitting security testing forms.

Need help? Contact support

Can this form be e-signed?
Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided intent, consent, attribution, and record retention requirements are met.
Are there exceptions to e-signature validity?
Certain documents remain excluded from electronic execution under law, such as wills and some court orders. Confirm whether the specific authorization or jurisdiction imposes exceptions before relying solely on e-signatures.
Is notarization required?
Not typically for testing authorization forms, but if a signature must be notarized by policy or contract, use in-person notarization or Remote Online Notarization according to the applicable state rules.
How do I protect PHI during testing?
Include HIPAA-compliant data handling clauses, limit scope, require encryption at rest and in transit, and execute a BAA when tests touch protected health information.
What file formats should I accept?
PDF is the standard for signed records. Also accept DOCX where necessary, but ensure the final stored copy is a secured PDF with an attached audit trail.
How do I revoke or cancel authorization?
Document revocation in writing with date and approver. Notify testers immediately, suspend testing access, and retain both the revoked form and the revocation notice for the record.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now