Can this agreement be signed electronically?

Yes. Electronic signatures are legally valid under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws adopted in most jurisdictions. Ensure intent, consent, attribution, and record retention are documented to satisfy the four-part legal validity test.

Do I need a HIPAA BAA attachment?

If the agreement covers protected health information or services to a covered entity, include a Business Associate Agreement and explicit PHI handling and breach-notification terms consistent with HIPAA and HITECH requirements.

What happens if a signer lacks authority?

An unauthorized signature may void contractual obligations. Verify signatory authority in the document (title and capacity), obtain corporate resolutions if required, and retain evidence of authority before relying on the agreement.

Is notarization required?

Not typically for IT Security Agreements. Some states or specific transaction types may require notarization or witnesses; confirm state rules when the agreement also creates or transfers interest in real property or is otherwise statutory in nature.

How do I revoke or amend the agreement?

Use an executed amendment or written termination signed by authorized parties. Document effective dates for amendments and preserve prior versions for retention and audit trails to avoid disputes.

How should signed copies be stored?

Store signed PDFs and the complete audit trail in a secure records system with encrypted storage, access controls, and backup. Maintain the retention schedule consistent with IRS, HIPAA, and industry standards.

Electronic Signature
Templates
Legal
IT Security Agreement

IT Security Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

IT SECURITY AGREEMENT

This IT Security Agreement (the "Agreement") is made and entered into as of by and between Client Name: , a organized under the laws of , with principal place of business at ; and Provider Name: , a organized under the laws of , with principal place of business at .

RECITALS

WHEREAS, Client requires the Provider to undertake services that involve access to Client systems, networks, and data in connection with the provision of IT services described in the scope of work; and

WHEREAS, Provider represents that it maintains administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of Client Data and to detect, prevent and respond to Security Incidents; and

WHEREAS, the parties desire to set forth their respective obligations regarding information security, incident response, audits, and the protection of Client Data under the terms and conditions of this Agreement.

NOW, THEREFORE, in consideration of the mutual covenants set forth herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement: "Confidential Information" means non-public information disclosed by one party to the other that is marked as confidential or that, by its nature or the circumstances of disclosure, should reasonably be understood to be confidential, including Client Data, system architecture, credentials, vulnerability reports and incident details. "Client Data" means all electronic data, content and information provided by or on behalf of Client to Provider in connection with the Services. "Security Incident" means any unauthorized access to, acquisition, use, disclosure, modification or destruction of Client Data or disruption of Services that compromises the confidentiality, integrity or availability of Client Data or the Services. "Services" means the IT, managed, cloud, support or other services to be provided by Provider pursuant to any statement of work or purchase order between the parties.

2. SECURITY OBLIGATIONS

Provider shall implement, maintain and continuously monitor administrative, physical and technical safeguards appropriate to the size and complexity of Provider's operations and the nature of Client Data, at a minimum including encryption in transit and at rest for sensitive Client Data where feasible, role-based access controls, multi-factor authentication for privileged access, logging and monitoring of access and changes, timely security patching consistent with industry practice, and secure configuration of systems.

Provider shall ensure that access to Client Data is limited to personnel with a legitimate business need and that such personnel are subject to confidentiality obligations. Provider will employ reasonable measures to prevent the use of default credentials, implement network segmentation where appropriate, and apply least-privilege principles to administrative accounts.

3. INCIDENT RESPONSE AND NOTIFICATION

Upon discovery of a Security Incident, Provider shall: (a) promptly take reasonable steps to contain and mitigate the impact of the Security Incident; (b) notify Client within of discovery, or sooner where required by applicable law; and (c) provide a written incident report describing the nature of the incident, the data and systems affected, the remediation measures taken and planned, and recommended actions for Client.

Provider shall cooperate with Client and, at Client's expense, with third-party forensic investigators retained by Client, to investigate the Security Incident and shall preserve relevant logs and evidence for a commercially reasonable period to support such investigation.

4. AUDITS AND ASSESSMENTS

Client or an independent auditor engaged by Client shall have the right, upon reasonable notice and during normal business hours, to assess Provider's compliance with the security obligations in this Agreement by reviewing policies, procedures, and evidence of controls, or by receiving copies of third-party audit reports (e.g., SOC 2 Type II). Such audits shall be conducted no more than unless a material Security Incident occurs. Provider shall promptly remediate any material deficiencies identified by an audit.

5. VULNERABILITY MANAGEMENT

Provider shall maintain a vulnerability management program that includes regular vulnerability scanning, prioritized remediation of critical vulnerabilities within a commercially reasonable period (not to exceed ), and documented change control procedures. Provider will notify Client of vulnerabilities that materially affect Client Data or Services and provide timelines for remediation.

6. CONFIDENTIALITY AND DATA PROTECTION

Provider shall treat Client Data as Confidential Information and shall not use, disclose or retain Client Data except as necessary to perform the Services or as otherwise authorized in writing by Client. Provider shall implement appropriate technical and organizational measures to protect Client Data against unauthorized or unlawful processing and accidental loss, destruction, or damage, consistent with applicable data protection laws.

Provider shall not transfer Client Data to any third party or across international borders except as expressly authorized by Client and only if the transferor ensures equivalent protections through contractual flow-down obligations and any legally required safeguards.

7. SUBPROCESSORS AND THIRD PARTIES

Provider shall provide Client with prior notice and obtain Client's written consent before engaging any subcontractor or third party that will process Client Data (a "Subprocessor"). Provider shall contractually require each Subprocessor to provide protections no less protective than those set forth in this Agreement and shall remain liable for Subprocessor performance.

8. LIABILITY AND INDEMNIFICATION

Each party's liability for direct damages arising from breach of this Agreement shall be limited to the greater of (i) the amounts paid or payable by Client to Provider under the Services during the twelve (12) month period preceding the claim or (ii) . Nothing in this Agreement shall limit liability for (a) willful misconduct or gross negligence, (b) breaches of confidentiality obligations, or (c) liability arising from Provider's indemnification obligations for third-party claims resulting from Provider's unauthorized disclosure or misuse of Client Data.

Provider shall indemnify and hold harmless Client from third-party claims arising out of Provider's breach of the security obligations in this Agreement or Provider's negligent acts or omissions in connection with the Services, subject to the limitations set forth in this Agreement.

9. INSURANCE

Provider shall maintain commercially reasonable cyber insurance and general liability insurance with limits sufficient to cover its obligations under this Agreement, including coverage for security breaches and privacy liabilities. Provider shall provide proof of such insurance upon Client's written request.

10. TERM, TERMINATION AND RETURN OF DATA

The term of this Agreement shall commence on the Effective Date and shall continue for the duration of the parties' Services relationship unless earlier terminated in accordance with the parties' master services agreement or as set forth herein. Upon expiration or termination, Provider shall, at Client's election, return or securely destroy all Client Data in Provider's possession within and certify in writing to Client that such destruction has occurred, except to the extent retention is required by applicable law, in which case Provider shall continue to protect such retained Client Data in accordance with this Agreement.

11. SURVIVAL

The provisions of this Agreement which by their nature should survive termination or expiration of this Agreement, including confidentiality, indemnification, liability, return or destruction of Client Data, and governing law, shall survive.

12. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the state of , without regard to its conflicts of law principles. The parties submit to the exclusive jurisdiction of the courts located in that state for disputes arising under this Agreement.

13. NOTICES

All notices, demands, or communications required or permitted under this Agreement shall be in writing and delivered to the addresses below or to such other addresses as the parties may designate in writing.

Client Notice Address Client Notice Contact (Name & Title) Provider Notice Address Provider Notice Contact (Name & Title)

14. AMENDMENT, WAIVER AND SEVERABILITY

No amendment or waiver of any provision of this Agreement shall be effective unless made in writing and signed by authorized representatives of both parties. The failure of either party to enforce any provision shall not constitute a waiver of future enforcement. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.

15. ENTIRE AGREEMENT

This Agreement, together with any statements of work, schedules or other written agreements expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior understandings and agreements, whether written or oral.

16. COUNTERPARTS

This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Signatures transmitted electronically or by facsimile shall be effective as originals.

SCOPE OF SECURITY SERVICES

Describe systems, services and security responsibilities Security Standards and Certifications (select all that apply)

SOC 2 Type II ISO 27001 NIST CSF Other:

ADDITIONAL REPRESENTATIONS

Provider represents and warrants that, to the best of its knowledge, there are no known vulnerabilities or misconfigurations in systems used to provide the Services that would result in a material and immediate risk to Client Data, and that Provider will notify Client promptly of any material change to the security posture that could reasonably be expected to affect Client.

Additional terms or notes

Client:

By:

Date:

Provider:

By:

Date:

What an IT Security Agreement Covers

An IT Security Agreement defines the responsibilities, controls, and expectations between parties that handle or access information technology systems and data. It typically addresses access permissions, authentication, data classification, encryption, monitoring and logging, third-party access, incident response, reporting timelines, and obligations after termination. The document sets performance standards, compliance requirements, and audit rights designed to reduce risk and provide a contractual basis for remediation, liability allocation, and regulatory notifications where applicable.

Why a Written IT Security Agreement Matters

A written agreement clarifies responsibilities, reduces legal ambiguity, and documents controls necessary to meet regulatory obligations such as HIPAA and sector-specific rules.

Who Typically Prepares and Signs These Agreements

Organizations of all sizes use IT Security Agreements to manage vendor relationships, cloud services, and intercompany access.

IT and security teams who define technical controls and approve access permissions.
Procurement and vendor management groups responsible for contract terms and risk assessment.
Legal and compliance functions that ensure regulatory obligations and contractual protections are met.

Identify the appropriate internal approvers and external signers before initiating the document to avoid delays.

Typical Signatories and Their Roles

Chief Information Officer

The CIO or equivalent executive signs when the agreement affects enterprise IT architecture, approves security controls, and accepts high-level risk allocations. They must confirm alignment with corporate security policy and budget for required remediation.

Vendor Security Officer

The vendor’s security lead or authorized representative signs to warrant controls, attest to compliance frameworks, and commit to breach notification processes. Their signature binds the vendor to operational and reporting obligations described in the agreement.

Essential Data Fields in the Agreement

Party Names: Full legal entity names

Effective Date: MM/DD/YYYY format

Scope: Systems and data covered

Controls: Encryption, MFA, logging

Notification: Breach reporting timelines

Retention: Recordkeeping obligations

Common Preparation Pitfalls to Avoid

Vague scope language that fails to name specific systems or data types, creating ambiguity about which assets the agreement governs.
Missing breach-notification details or inconsistent timelines compared to regulatory requirements, which can delay compliance reporting.
Insufficient authentication requirements (for example, omitting multi-factor authentication) that leave remote access controls under-specified.
Failure to define escalation paths, audit rights, and remediation steps, which prolongs incident response and dispute resolution.

Core Clauses to Include in a Professional IT Security Agreement

A strong agreement groups technical obligations, governance, and remedies into clear sections so all parties can operationalize requirements.

Scope

Define systems, data categories, and environments covered by the agreement, including production, staging, and test systems, and specify any excluded assets.

Roles & Responsibilities

Assign duties for security operations, monitoring, patching, backups, and access provisioning, including which party owns incident response and threat intelligence sharing.

Access Controls

Specify authentication methods, least-privilege principles, privileged access management, password policies, and multi-factor authentication requirements.

Data Handling

Describe encryption in transit and at rest, data classification, permitted processing, data sharing limits, and rules for data export or transfer across jurisdictions.

Incident Response

Set breach detection, internal escalation, external notification timelines, forensic obligations, and required coordination with affected parties and regulators.

Audit & Reporting

Include audit rights, reporting frequency, evidence delivery formats, and remediation tracking; specify acceptable certifications or third-party assessment reports.

Step-by-Step: Completing the IT Security Agreement

Follow this sequential checklist to prepare, review, and finalize the agreement with minimal rework.

01

Draft Scope: List systems and data, then define exclusions clearly.
02

Specify Controls: Insert encryption, access, and monitoring requirements.
03

Agree Timelines: Set response, remediation, and reporting deadlines.
04

Execute Signatures: All authorized parties sign and date the completed document.

Configuring an Online Review and Signature Workflow

Use consistent workflow settings to reduce signer friction and preserve audit evidence during e-signature and routing.

Field	Configuration
Authentication	Email link + optional SMS code
Signing Order	Sequential or parallel signer order
Conditional Fields	Show/hide fields based on role or answer
Retention Export	Auto-export signed PDF to secure archive

Where the Agreement Goes After Signing

Map document routing so each team knows custody and access after the agreement is executed.

Document Owner: Legal or vendor management retains master copy
Security Team: Stores controls and integrates with asset inventory
Audit Archive: Signed copy plus audit trail saved to records
Operational Teams: Receive obligations and remediation tasks

Digital Signing and File Format Considerations

Choose a platform that supports common document formats, strong encryption, and an auditable signing trail for legal defensibility.

File Formats: PDF, DOCX, and flat text supported
Encryption: TLS 1.2/1.3 in transit
Integrations: CRM and cloud storage connectors

Key Deadlines and Timing Expectations

Specify clear timing for review, signature, and incident reporting; legal and regulatory obligations often set outer limits.

Internal Review Period:

Allow 7–14 business days for legal and security review

Signer Turnaround Goal:

Target 14 calendar days to complete signature cycle

Incident Escalation:

Report internally within 72 hours of detection

Regulatory Notice:

Follow sector rules; HIPAA breach notices often required within 60 days (see 45 CFR §§164.400–414)

Policy Review Cycle:

Revisit agreement annually or when systems change

Milestone Timeline from Draft to Enforcement

A milestone view helps stakeholders see approval, signature, and activation points for operational readiness.

01

Drafting

Create initial agreement and attach technical exhibits and control matrices.

02

Internal Approval

Legal, security, and procurement approve terms and risk allocation.

03

Signing

Authorized signatories execute the agreement using an auditable e-sign process.

04

Activation

Operational teams enact controls, keys, and access permissions per the agreement.

Real-World Examples of IT Security Agreements in Use

These concise examples illustrate typical outcomes when agreements are implemented alongside secure signing and recordkeeping.

Tech Data (Enterprise IT)

The vendor standardized security clauses across global contracts to reduce review cycles.

Rapid deployment cut negotiation by weeks.
By centralizing templates and audit evidence, the company improved compliance traceability while reducing legal review time for recurring engagements.

Fertility Centers of Illinois (Healthcare)

The organization required HIPAA addenda and explicit breach procedures with vendors.

Added BAA and reporting timelines.
After implementing structured agreements and consistent signature capture, the center documented compliance obligations and reduced vendor onboarding delays.

eSignature Pricing and Feature Comparison (signNow first)

Compare starting prices and fundamental feature availability across common e-signature vendors to inform platform selection for executing IT Security Agreements.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (available on premium tiers)	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently Asked Questions about IT Security Agreements

Answers to common legal and operational questions when preparing, signing, and storing IT Security Agreements.

Need help? Contact support

Can this agreement be signed electronically?
Yes. Electronic signatures are legally valid under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws adopted in most jurisdictions. Ensure intent, consent, attribution, and record retention are documented to satisfy the four-part legal validity test.
Do I need a HIPAA BAA attachment?
If the agreement covers protected health information or services to a covered entity, include a Business Associate Agreement and explicit PHI handling and breach-notification terms consistent with HIPAA and HITECH requirements.
What happens if a signer lacks authority?
An unauthorized signature may void contractual obligations. Verify signatory authority in the document (title and capacity), obtain corporate resolutions if required, and retain evidence of authority before relying on the agreement.
Is notarization required?
Not typically for IT Security Agreements. Some states or specific transaction types may require notarization or witnesses; confirm state rules when the agreement also creates or transfers interest in real property or is otherwise statutory in nature.
How do I revoke or amend the agreement?
Use an executed amendment or written termination signed by authorized parties. Document effective dates for amendments and preserve prior versions for retention and audit trails to avoid disputes.
How should signed copies be stored?
Store signed PDFs and the complete audit trail in a secure records system with encrypted storage, access controls, and backup. Maintain the retention schedule consistent with IRS, HIPAA, and industry standards.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now