Can the exhibit be signed electronically?

Yes. Electronic signatures are enforceable under the federal ESIGN Act and state UETA laws where adopted, provided intent, consent, attribution, and record retention requirements are met.

Is notarization usually required?

Not typically for a security exhibit alone; notarization is necessary only when specific state law or the agreement requires it. Verify based on governing state.

Who must sign the exhibit?

Authorized corporate representatives with signing authority should sign. Include titles and ensure the person has the delegated authority to bind the organization.

What authentication is sufficient?

Email verification or SMS code is common for commercial contracts. For higher assurance, use multi-factor authentication or certificate-based signatures.

How should executed exhibits be stored?

Store signed exhibits in a secure contract repository with immutable audit logs and exportable copies. Maintain retention per regulatory and contract requirements.

Can the exhibit be amended later?

Yes. Amendments should be documented in writing, reference the original exhibit, and be signed by the same level of authorized signatories as the original.

Electronic Signature
Templates
Legal
Legal SRA Exhibit

Legal SRA Exhibit

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL SRA EXHIBIT

This Exhibit (the Exhibit) is made effective as of Effective Date: and is entered into by and between Client Name: and Provider Name: . This Exhibit is incorporated by reference into the Services Reseller Agreement dated Agreement Date: (the Agreement).

RECITALS

WHEREAS, Provider is engaged in the business of providing the services described herein and has the qualifications, experience and ability to perform such services in accordance with the terms of the Agreement and this Exhibit;

WHEREAS, Client desires to procure certain services and Deliverables from Provider as set forth in this Exhibit and the parties desire to set forth the specific scope, deliverables, schedule and pricing applicable to such services;

WHEREAS, the parties intend that the terms of this Exhibit shall govern the performance of the services to the extent they conflict with any provision of the Agreement.

NOW, THEREFORE, in consideration of the mutual promises contained herein and for other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. DEFINITIONS

Capitalized terms used but not defined in this Exhibit have the meanings assigned in the Agreement. For purposes of this Exhibit, the following definitions apply: "Deliverables" means the tangible or intangible outputs described in Section 3 delivered to Client pursuant to this Exhibit; "Acceptance Criteria" means the written criteria set forth in Section 3.2 by which Client will accept or reject Deliverables.

2. SCOPE OF SERVICES

Provider shall perform the services described below in accordance with the schedules and standards set forth in this Exhibit. The services to be performed are summarized as follows:

Summary of Services:

3. DELIVERABLES; ACCEPTANCE

3.1 Deliverables. Provider shall provide the Deliverables described in the Deliverable Schedule below. Each Deliverable shall be labeled and accompanied by such documentation as reasonably necessary for Client to evaluate the Deliverable.

Deliverable 1 description: Deliverable 1 due date: Deliverable 2 description (optional): Deliverable 2 due date (optional):

3.2 Acceptance. Client shall have Acceptance Period: days from delivery to inspect each Deliverable against the Acceptance Criteria. If Client provides written notice of rejection with reasonable detail within the Acceptance Period, Provider shall, at its expense, correct the Deliverable and re-submit for acceptance. Failure to timely provide rejection notice constitutes deemed acceptance.

4. FEES AND PAYMENT

4.1 Fees. In consideration of the performance of the services and delivery of the Deliverables, Client shall pay Provider fees in the amounts set forth below and in accordance with the payment schedule.

Total Fee (USD): Payment Terms:

4.2 Taxes and Expenses. All fees are exclusive of taxes, duties and third-party costs. Client shall reimburse Provider for pre-approved out-of-pocket expenses, provided Provider furnishes reasonable substantiation.

5. TERM; TERMINATION

5.1 Term. The services under this Exhibit shall commence on Service Start Date: and shall continue until Service End Date: unless earlier terminated in accordance with this Section.

5.2 Termination for Cause. Either party may terminate this Exhibit for material breach by the other party if the breach remains uncured for a period of thirty (30) days after written notice specifying the breach. Termination shall be without prejudice to any other remedy available at law or in equity.

6. CONFIDENTIALITY

Each party shall maintain in confidence the Confidential Information of the other party and shall not disclose or use such Confidential Information except as required to perform its obligations under this Exhibit. Confidential Information excludes information that is or becomes publicly available without breach, independently developed, or rightfully received from a third party.

7. INTELLECTUAL PROPERTY

7.1 Ownership. Provider retains all right, title and interest in and to Provider's Preexisting IP. Client retains all right, title and interest in and to Client Materials. Except as expressly set forth herein, no license or transfer of ownership is made by either party.

7.2 Deliverables. Upon receipt of full payment of undisputed fees, Provider grants Client a perpetual, non-exclusive, non-transferable license to use the Deliverables solely for Client's internal business purposes, subject to Provider's retained moral rights and third-party licenses.

8. REPRESENTATIONS; WARRANTIES

Provider represents and warrants that (a) it will perform the services in a professional and workmanlike manner consistent with industry standards, and (b) the Deliverables, when used in accordance with documentation and this Exhibit, will materially conform to the Acceptance Criteria. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS SECTION, PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

9. INDEMNIFICATION; INSURANCE

9.1 Indemnification by Provider. Provider shall indemnify, defend and hold harmless Client from and against any third-party claim arising out of Provider's gross negligence, willful misconduct, or material breach of the warranties in Section 8, provided Client gives prompt written notice and cooperates in the defense.

9.2 Insurance. Provider shall maintain insurance customary for the services provided, including commercial general liability and professional liability with limits not less than Minimum Insurance Amount (USD): , and shall furnish certificates upon request.

10. LIMITATION OF LIABILITY

Except for liability arising from gross negligence, willful misconduct, breach of confidentiality, or indemnification obligations, neither party's aggregate liability to the other for claims arising out of this Exhibit shall exceed the Liability Cap (USD): or the total fees paid under this Exhibit, whichever is greater.

11. NOTICES

All notices under this Exhibit shall be in writing and delivered to the address specified below or to such other address as either party may designate by notice to the other in accordance with this Section. Notices shall be deemed given when delivered by hand, by nationally recognized overnight courier, or three (3) days after deposit in the mail with first-class postage prepaid.

Client Notice Address: Provider Notice Address:

12. AMENDMENT

This Exhibit may be amended only by a written instrument duly executed by authorized representatives of both parties. No course of dealing, usage of trade, or failure to enforce any right shall modify this Exhibit.

13. WAIVER

No waiver of any term or condition of this Exhibit shall be effective unless in writing and signed by the waiving party. The waiver of any breach shall not be construed as a waiver of any subsequent breach.

14. GOVERNING LAW

This Exhibit shall be governed by and construed in accordance with the laws of Governing State: without regard to its conflict of law principles.

15. ENTIRE AGREEMENT

This Exhibit, together with the Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, representations and understandings, whether written or oral, relating to such subject matter.

16. SEVERABILITY

If any provision of this Exhibit is held invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect to the fullest extent permitted by law.

17. COUNTERPARTS

This Exhibit may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Signatures delivered by electronic means shall be binding.

18. MISCELLANEOUS

Headings are for convenience only and shall not affect interpretation. The obligations of the parties that by their nature survive termination or expiration shall survive as provided herein.

Special Instructions / Additional Terms:

IN WITNESS WHEREOF, the parties hereto have caused this Exhibit to be executed by their duly authorized representatives as of the dates set forth below.

Client

Printed Name:

By:

Date:

Provider

Printed Name:

By:

Date:

What a Legal SRA Exhibit Is and when it’s attached

A Legal SRA Exhibit is a contract attachment that documents security-related representations, specific responsibilities, and agreed controls between parties. It typically lists required security measures, reporting obligations, incident response steps, and minimum technical standards tied to a master agreement. The exhibit clarifies allocation of risk, evidence collection procedures, and any review or audit schedules. In U.S. commercial and healthcare contexts it supports compliance with applicable laws and contract performance expectations while serving as an enforceable part of the governing agreement.

Why including a clear SRA Exhibit matters

A precise Legal SRA Exhibit reduces ambiguity about responsibilities, improves audit readiness, and documents the standard of care parties must meet. It makes compliance expectations explicit and helps avoid disputes over scope or remediation duties.

Who commonly prepares and signs an SRA Exhibit

The Legal SRA Exhibit is used by teams across procurement, security, and legal to document controls and obligations.

Security and compliance teams — Draft technical controls, testing, and breach notification timelines for vendor oversight.
Procurement and contracting teams — Attach exhibit to master services agreements, define acceptance criteria and remediation windows.
Legal counsel and outside counsel — Review enforceability language, liability limits, and applicable governing law selections.

Multiple stakeholders sign or approve the exhibit so the contract reflects operational and compliance realities before performance begins.

Typical signatories and document owners

Contract Manager

The Contract Manager organizes exhibit versioning, ensures the exhibit is attached to the main agreement, and confirms that operational teams accept the obligations. They coordinate signatory order and maintain the executed exhibit in the contract repository for audit readiness.

Chief Privacy Officer

The CPO or equivalent reviews data classification, retention, and breach-notification clauses to confirm regulatory alignment. They typically sign or provide written approval when the exhibit impacts HIPAA, state privacy laws, or other regulated personal data processing.

Core elements to include in a professional SRA Exhibit

A complete Legal SRA Exhibit combines governance, controls, reporting, and remediation details so obligations are measurable and enforceable. Include clear timelines, responsible parties, acceptance criteria, and escalation paths.

Scope

Define covered systems, geographic limits, and data types. Specify which services and subcontractors are in scope for controls and reporting.

Security Controls

List required technical and organizational measures such as encryption standards, access control, vulnerability management, and logging with minimum configurations.

Audit Rights

Describe audit frequency, documentation required, and acceptable formats for evidence. Include whether third-party reports satisfy audit obligations.

Incident Response

State notification timelines, required content of breach reports, remediation timelines, and coordination procedures for legal and forensic activities.

Roles & Responsibilities

Assign who performs monitoring, reporting, remediation, and escalation. Specify contacts and change-notification obligations for key personnel.

Acceptance Criteria

Define how compliance will be measured, thresholds for acceptable risk, and consequences for failing to meet requirements.

Step-by-step: complete and finalize the SRA Exhibit

Follow these sequential steps to prepare, approve, and execute the Legal SRA Exhibit so it becomes enforceable as part of the underlying agreement.

01

Prepare Exhibit: Draft controls, scope, and timelines consistent with the contract.
02

Review Internally: Have security, procurement, and legal review and approve the text.
03

Attach to Agreement: Append the exhibit to the master agreement and reference it in the body of the contract.
04

Execute and Store: Collect signatures and store the executed exhibit with the contract file.

How an SRA Exhibit flows through contract processes

The exhibit moves from drafting to approval and execution; each stage captures specific approvals and records. Below are the typical operational steps.

Drafting: Author creates initial exhibit with control requirements.
Stakeholder Review: Security, privacy, and legal teams comment and revise.
Signatory Approval: Authorized corporate signers confirm obligations and sign.
Recordkeeping: Executed exhibit is archived with version history and audit trail.

Digital workflow settings for online completion

Configure these common workflow settings to ensure secure, auditable electronic execution of the SRA Exhibit.

Field	Configuration
Authentication	Email link, SMS code, or advanced signer verification
Signing Order	Sequential or parallel signing as required by approval flow
Notifications	Automatic reminders and completion confirmations
Retention	Set read-only storage and exportable audit logs

Technical considerations for eSigning and eSubmission

Use a platform that supports secure signatures, audit trails, and required integrations for your contract ecosystem.

File formats: PDF, DOCX supported
Integrations: Salesforce, NetSuite, Google Workspace
Security: TLS in transit; AES-256 at rest

Common mistakes when preparing the SRA Exhibit

Vague control descriptions — failing to specify encryption standards or acceptable log retention leads to interpretation disputes during audits.
Missing signatories — forgetting an authorized corporate signer can render the exhibit unenforceable or delay contract start dates.
Incomplete contact details — absent notification contacts slow incident response and breach reporting to affected parties and regulators.
Improper attachment — not referencing the exhibit in the main agreement body can create ambiguity about whether the exhibit is part of the contract.

Potential consequences of an incorrect or missing exhibit

Contractual Liability: Damages and indemnity obligations

Regulatory Fines: Penalties for noncompliance

Breach Costs: Remediation and notification expenses

Operational Delays: Project hold or suspension

Reputational Harm: Loss of customer trust

Audit Findings: Remediation orders and increased oversight

eSignature vendor comparison for signing and managing exhibits

Compare common pricing and capability criteria for platforms used to execute a Legal SRA Exhibit. signNow is listed first per comparison convention.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about completing and signing the SRA Exhibit

Answers to common questions cover signature methods, witness requirements, electronic validity, and recordkeeping so you can avoid typical execution issues.

Need help? Contact support

Can the exhibit be signed electronically?
Yes. Electronic signatures are enforceable under the federal ESIGN Act and state UETA laws where adopted, provided intent, consent, attribution, and record retention requirements are met.
Is notarization usually required?
Not typically for a security exhibit alone; notarization is necessary only when specific state law or the agreement requires it. Verify based on governing state.
Who must sign the exhibit?
Authorized corporate representatives with signing authority should sign. Include titles and ensure the person has the delegated authority to bind the organization.
What authentication is sufficient?
Email verification or SMS code is common for commercial contracts. For higher assurance, use multi-factor authentication or certificate-based signatures.
How should executed exhibits be stored?
Store signed exhibits in a secure contract repository with immutable audit logs and exportable copies. Maintain retention per regulatory and contract requirements.
Can the exhibit be amended later?
Yes. Amendments should be documented in writing, reference the original exhibit, and be signed by the same level of authorized signatories as the original.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now