Can this form be signed electronically?

Yes. Electronic signatures meet legal requirements under the ESIGN Act (15 U.S.C. ch. 96) and UETA in adopted states. Confirm that the specific transaction is not an exception (wills, certain court filings) before relying on eSign.

Is notarization required for the form?

Typically no for IT Application Security Forms unless a contract, sworn declaration, or state rule specifically requires notarization. If notarization is mandated, consider Remote Online Notarization where permitted and compliant with state rules.

How should PHI or other sensitive data be handled?

If the form includes PHI, follow HIPAA safeguards: execute a BAA, limit access, use AES-256 at rest and TLS 1.2/1.3 in transit, and retain records per 45 CFR §164.530(j). Redact or separate unnecessary PHI where possible.

What constitutes a legally valid e-signature?

A legally valid e-signature requires demonstrated intent to sign, consent to transact electronically, attribution to the signer, and record retention/reproducibility consistent with ESIGN/UETA standards.

How long must completed forms be retained?

Retention varies by regulator: IRS records 3 years (IRC §6501(a)), HIPAA 6 years (45 CFR §164.530(j)), I-9 rules 3 years after hire or 1 year after termination; retain longer when industry or state rules require.

How do I correct mistakes after signing?

Issue an amendment or a new form that documents the correction, obtain signatures from affected parties, and retain both original and amendment to preserve an auditable history for reviewers or auditors.

Electronic Signature
Templates
Miscellaneous
IT Application Security Form

IT Application Security Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

IT APPLICATION SECURITY AGREEMENT

This IT Application Security Agreement ("Agreement") is entered into by and between the parties identified below for the purpose of establishing application security responsibilities, controls, acceptance criteria, and remediation obligations associated with the application identified herein.

Parties

Client Name: Service Provider Name:

Recitals

WHEREAS, the Client maintains or manages the application identified as (the "Application"), which processes, stores, or transmits Client data; and

WHEREAS, the Service Provider performs services related to development, maintenance, hosting, or security testing of the Application and warrants to implement and maintain reasonable technical, administrative, and physical safeguards as set forth herein; and

WHEREAS, the parties desire to document security requirements, assessment procedures, remediation obligations, acceptance criteria, and related payment and termination terms applicable to the Application.

Scope of Work

The Service Provider shall perform the security tasks described below and any related deliverables necessary to bring the Application into compliance with the security requirements of this Agreement.

Detailed scope and deliverables:

Application & Data Classification

Application Environment:

Data classification (check all that apply):

Public Internal Confidential Restricted

Types of data processed by the Application:

Security Controls and Requirements

The Service Provider shall maintain the following minimum controls for the Application. Check the controls that apply and provide comments where required.

Multi-factor authentication (MFA) for privileged and administrative access

Encryption at rest for sensitive data

Encryption in transit (TLS 1.2+)

Centralized logging and monitoring with retention policy

Regular vulnerability scanning and remediation tracking

Secure development lifecycle practices (static analysis, code review)

Control exceptions or comments:

Risk Assessment & Remediation

The Service Provider shall conduct an initial risk assessment and provide a remediation plan for identified vulnerabilities. For each vulnerability, the Service Provider will assign a priority and target remediation date.

Has a current vulnerability assessment been completed?

Yes No

Summary of known vulnerabilities and remediation timelines:

Acceptance Criteria

Acceptance of remediation and security deliverables will be based on the following criteria. Service Provider must demonstrate that high-risk findings are mitigated or a documented and approved compensating control is in place prior to final acceptance.

Acceptance testing procedure summary:

Payment Terms

Compensation for security-related services under this Agreement shall be as follows.

Total amount payable: Payment schedule / milestones: Late fee for overdue payments:

Term and Termination

This Agreement commences on the Start Date and continues until the End Date, unless earlier terminated in accordance with this section.

Start Date: End Date:

Notice period for termination (days): Immediate termination events:

Confidentiality and Data Protection

The parties acknowledge that in performing under this Agreement each party may receive Confidential Information. Each party agrees (i) to hold Confidential Information in strict confidence using the same degree of care it uses to protect its own confidential information but not less than reasonable care; (ii) not to disclose Confidential Information to any third party except as authorized by this Agreement; and (iii) to use Confidential Information solely to perform obligations under this Agreement. Confidential Information includes security assessments, vulnerability reports, remediation plans, and any data classified as Confidential or Restricted above.

In the event of a security incident or data breach affecting the Application, the Service Provider shall: (a) notify the Client without undue delay; (b) cooperate in investigation and mitigation; and (c) comply with applicable legal and regulatory obligations to protect affected individuals and data.

Representations, Warranties & Liability

The Service Provider represents and warrants that it will perform services in a professional manner consistent with industry standards and applicable laws. Except as expressly provided in this Agreement, neither party makes any other warranties. Liability for direct damages will be limited to the total fees paid under this Agreement for the services giving rise to the claim; neither party will be liable for consequential or punitive damages except for willful misconduct or gross negligence.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction agreed by the parties. The parties submit to the exclusive jurisdiction of the courts of that jurisdiction for disputes arising out of this Agreement.

Entire Agreement

This Agreement, including any attachments and statements of work referenced herein, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements and understandings, whether written or oral. Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

Administrative & Contact Information

Client technical contact (name, title, phone, email): Service Provider technical contact (name, title, phone, email):

Client:

By:

Date:

Service Provider:

By:

Date:

What the IT Application Security Form Documents

The IT Application Security Form documents an application's security posture by recording identification details, data classification, access and authentication controls, encryption standards, third-party connections, known vulnerabilities, and remediation plans. Organizations use it for procurement reviews, deployment approvals, change control, and audit evidence to show that technical and administrative safeguards meet internal policy and applicable regulatory requirements. A completed form provides an auditable record for security teams, risk owners, compliance reviewers, and external auditors, and supports informed decisions about production authorization or required mitigations prior to go-live.

Why this form matters for governance and compliance

The IT Application Security Form centralizes evidence of controls and risk posture, streamlines approval workflows, and supports regulatory compliance such as HIPAA and industry standards. It reduces audit preparation time, clarifies remediation priorities, and provides consistent decision criteria for security, procurement, and business stakeholders.

Who completes and relies on the IT Application Security Form

Typical users who complete or rely on the IT Application Security Form include application owners, security engineers, and compliance officers during procurement and review cycles.

Application owners — provide app details, architecture, and business justification as required.
Security engineers — document controls, encryption, authentication, and remediation timelines with evidence.
Compliance officers and auditors — verify regulatory alignment and approve exceptions.

Responses are used by review boards to approve deployments, request mitigations, or escalate residual risks to executive leadership.

Essential sections to include in a professional form

A complete IT Application Security Form groups information into consistent sections so reviewers can compare applications, assess risk, and track remediation. Include scope, access controls, data protection, vulnerability findings, third-party risk, and approval history to support governance and audits.

Scope

Identify application name, version, deployment environment, purpose, sensitive data types processed, and business units accountable. Clear scope prevents misclassification and ensures controls align with operational risks and compliance obligations.

Access Controls

Describe authentication methods, role-based access, privileged account handling, MFA enforcement, session timeouts, and periodic access reviews. Include evidence such as configurations, logs, and policies to validate implementation.

Data Protection

Specify encryption in transit and at rest, key management, tokenization, data minimization practices, and backup procedures. Indicate standards used such as TLS 1.2/1.3 and AES-256 and how certificates are managed.

Vulnerabilities

List discovered vulnerabilities with CVE identifiers, severity, exploitability, remediation owner, planned fix dates, and compensating controls implemented while fixes are pending.

Third-Party Risk

Document vendor integrations, data flows, contract terms requiring attestations or a BAA, and the vendor's security posture including SOC 2 or equivalent evidence where available.

Approval & Audit

Record reviewers, approval eSign evidence, audit trail metadata (timestamps, IPs), and retention location so the form supports dispute resolution and regulatory inspection.

Required fields and key data elements

Application ID: Unique application name or ID string.

Owner Contact: Name, role, and email.

Data Classification: Public, Internal, Confidential, Regulated.

Auth Methods: Password, MFA, SSO details.

Encryption Standards: TLS 1.2 or 1.3; AES-256 at rest.

Audit Trail Location: Central log store with timestamps.

Step-by-step: completing the IT Application Security Form

Follow these steps to complete the IT Application Security Form accurately and create an auditable security record for review.

01

Prepare: Gather inventory, architecture diagrams, and supporting evidence.
02

Document: Complete sections for controls, data classification, and third parties.
03

Validate: Security team reviews entries and requests clarifications where needed.
04

Approve: Authorized reviewers sign and record audit metadata for retention.

Where to file or send completed forms

Common destinations for completed IT Application Security Forms include governance repositories, procurement attachments, and audit folders to ensure discoverability and traceability.

Security Repo: Store in central GRC or log archive.
Procurement: Attach to purchase orders and vendor files.
Audit Team: Provide copies for internal or external auditors.
Third Parties: Share redacted extracts under NDA or BAA.

Delivery methods, integrations, and technical requirements

Choose distribution channels and platform requirements based on security, integrations, and signer authentication needs.

Supported Formats: PDF, DOCX, and XLSX supported.
Integrations: Salesforce, NetSuite, Google Workspace.
Authentication: Email, SMS code, KBA, or SSO.

How to configure online workflows for this form

Configure fields, conditional logic, and signer order so the online form matches your review and approval process.

Field	Configuration
Signature Field	Required with timestamp and signer metadata
Conditional Field	Show when risk rating equals High
Authentication	Email link plus optional SMS code
Routing	Sequential approval order with escalation

Typical timelines and processing expectations

Use these timeframes as guidance for reviews, deployment gating, and responses to audit or incident requests.

Procurement Review:

Complete prior to contract execution or payment release.

Change Control:

Update before any production deployment or major version release.

Annual Review:

Reassess controls at least once per year for compliance.

Security Incident:

Provide updated findings within 72 hours of detection.

Audit Response:

Deliver requested forms within typical audit windows (10–30 days).

Key milestones from submission through approval

Major stages in the assessment lifecycle show who must act and when to close the loop on remediation and approval.

01

Request Submission

Requester uploads form and supporting evidence to the repository.

02

Technical Review

Security team validates controls and documents findings and gaps.

03

Remediation

Owners assign fixes, schedule work, and apply compensating controls.

04

Final Approval

Approvers sign, record audit trail, and authorize production use.

Common mistakes that delay review and approval

Incomplete fields leave critical controls unspecified, causing reviewers to underestimate risk and request more information during procurement or deployment.
Inconsistent data classification results in improper handling of regulated data and missing required safeguards such as encryption or logging.
Failing to attach supporting evidence such as logs, config screenshots, or vendor attestations increases audit friction and triggers multiple follow-up requests.
Relying on outdated assessments without version or date stamps leads to reliance on stale vulnerability information and inaccurate remediation status.

Penalties and risks from incorrect or missing information

Regulatory fines: HIPAA fines or state sanctions.

Operational downtime: Service outages and remediation costs.

Data breach liability: Notification costs and legal exposure.

Contract defaults: Breach of vendor or customer agreements.

Reporting penalties: I-9, tax, or audit fines may apply.

Reputational harm: Customer loss and reduced trust.

Pricing and feature comparison for eSignature options

Compare starting prices and feature availability across common eSignature vendors. signNow is shown first for clarity; verify vendor plans and contract terms before purchase.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Real-world examples of how organizations use the form

Actual customer implementations show how the form reduces friction, standardizes reviews, and supports rapid approvals across teams.

Optica Ventures LLC

Optica used the form to standardize application security intake across its portfolio, improving consistency and review speed.

Simplified intake and clearer ownership across teams.
Brian Fitzgibbons, COO: "The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers." Implementation reduced review cycles and improved audit readiness across applications.

Tech Data

Tech Data integrated structured forms into procurement and revenue workflows to accelerate approvals and reduce manual handoffs.

Faster internal approvals and better tracking.
Bob Dutkowsky, CEO: "Tech Data uses airSlate SignNow to improve our internal and external customer service while increasing our speed to revenue." The form provided consistent evidence for finance and security reviews.

Frequently asked questions about the IT Application Security Form

Answers to common questions about legal validity, notarization, PHI handling, retention, and correcting signed records.

Need help? Contact support

Can this form be signed electronically?
Yes. Electronic signatures meet legal requirements under the ESIGN Act (15 U.S.C. ch. 96) and UETA in adopted states. Confirm that the specific transaction is not an exception (wills, certain court filings) before relying on eSign.
Is notarization required for the form?
Typically no for IT Application Security Forms unless a contract, sworn declaration, or state rule specifically requires notarization. If notarization is mandated, consider Remote Online Notarization where permitted and compliant with state rules.
How should PHI or other sensitive data be handled?
If the form includes PHI, follow HIPAA safeguards: execute a BAA, limit access, use AES-256 at rest and TLS 1.2/1.3 in transit, and retain records per 45 CFR §164.530(j). Redact or separate unnecessary PHI where possible.
What constitutes a legally valid e-signature?
A legally valid e-signature requires demonstrated intent to sign, consent to transact electronically, attribution to the signer, and record retention/reproducibility consistent with ESIGN/UETA standards.
How long must completed forms be retained?
Retention varies by regulator: IRS records 3 years (IRC §6501(a)), HIPAA 6 years (45 CFR §164.530(j)), I-9 rules 3 years after hire or 1 year after termination; retain longer when industry or state rules require.
How do I correct mistakes after signing?
Issue an amendment or a new form that documents the correction, obtain signatures from affected parties, and retain both original and amendment to preserve an auditable history for reviewers or auditors.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now