Are electronic signatures valid for this document?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA, electronic signatures are generally legally equivalent to handwritten signatures, except where federal or state law creates an explicit exception.

Do I need a notary for the Security Information Document?

Not always. Notarization depends on the document purpose and state recording requirements. If a deed, power of attorney, or other record requires a notary, follow state-specific rules.

What authentication level is required?

Choose authentication based on risk: email-only for low risk, SMS or knowledge‑based verification for moderate risk, and multi-factor or certified signatures for high risk or regulatory needs.

How long must I retain the document?

Retention depends on the type of records: follow federal minima (e.g., IRS three years, HIPAA six years) and extend retention where contract, state law, or industry rules require longer periods.

Can I use a third party to store signed copies?

Yes, provided the vendor meets your security and contractual requirements. Ensure encryption at rest and transit, and that access controls and audit logs meet your compliance needs.

What happens if a party's legal name is wrong?

Name mismatches can create enforceability or acceptance issues. Correct errors before signature or use an amendment signed by all parties to avoid disputes.

Electronic Signature
Templates
Miscellaneous
Security Information Document

Security Information Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Security Information Document

Parties and Effective Date

Security Provider: Client Name:

Effective Date:

WHEREAS

WHEREAS, Security Provider is engaged in the business of providing security services, risk assessment, and asset protection and possesses the personnel, credentials, and insurance necessary to perform such services; and

WHEREAS, Client requires security services and information about on-site and off-site security protocols, designated contacts, and asset control measures to be documented for operational and compliance purposes; and

WHEREAS, the parties desire to set forth the security information, scope of work, payment terms, confidentiality obligations, and procedures for incidents and termination in this Security Information Document.

Scope of Work

Scope of Services and Deliverables

Security Operations and Protocols

On-site Security Plan Summary Access Control and Credentials Emergency and Incident Reporting Contacts

Are security personnel authorized to carry defensive devices or firearms? Yes No

Background Check and Licensing Requirements Keys, Access Cards, and Keying Schedule

Payment Terms

Total Contract Amount: $

Payment Schedule

Late Payment Fee:

Term and Termination

Term Start Date: Term End Date:

Either party may terminate this document for convenience upon written notice to the other party provided at least days prior to the effective termination date. Termination for material breach is effective immediately upon written notice if the breaching party fails to cure within days after receipt of written notice.

Confidentiality

Each party acknowledges that during the course of performance it may receive Confidential Information of the other party. "Confidential Information" includes, but is not limited to, security plans, access codes, lists of personnel, incident reports, and third-party vendor pricing. Each party shall:

(a) use Confidential Information solely for performance under this document; (b) restrict disclosure to employees, contractors, or agents with a need to know and subject to comparable confidentiality obligations; and (c) implement reasonable administrative and technical safeguards to protect such information from unauthorized disclosure. Confidential Information does not include information that is or becomes publicly known through no fault of the receiving party, is rightfully received from a third party without restriction, or is independently developed.

Incident Reporting and Investigation

Incident Reporting Procedure Post-Incident Deliverables (reports, timelines, corrective actions)

Insurance, Certifications, and Compliance

Insurance and Certifications to be Maintained by Security Provider

Governing Law and Dispute Resolution

This Security Information Document shall be governed by and construed in accordance with the laws of the State or jurisdiction specified by Client: . The parties agree to submit disputes first to good faith negotiation and, if unresolved, to binding arbitration or other dispute resolution method as mutually selected in writing.

Representations and Warranties

Each party represents that it has the authority to enter into this document, that the persons executing this document are duly authorized, and that performance will comply with applicable laws and regulations. Security Provider further warrants that personnel provided meet the background, licensing and training standards set forth in this document.

Indemnification and Limitation of Liability

Each party shall indemnify the other for claims arising from its negligent acts, willful misconduct, or material breach of this document. Neither party shall be liable for consequential, incidental, or punitive damages except to the extent such damages result from gross negligence or willful misconduct.

Entire Agreement

This Security Information Document, together with any attachments and schedules expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior agreements, proposals, and communications. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

Additional Administrative Information

Designated Security Contact (Security Provider) Designated Client Contact Primary Site Address Additional Notes or Special Instructions

Security Provider (Printed Name):

By:

Date:

Client (Printed Name):

By:

Date:

What the Security Information Document Is and When it Applies

A Security Information Document is a formal record that describes security controls, responsibilities, and incident response procedures tied to a specific transaction, agreement, or system environment. In practice it documents who holds security responsibility, what safeguards protect data, the retention and access restrictions for records, and steps for reporting and remediating incidents. Organizations use this document to demonstrate due diligence to partners, auditors, and regulators and to align contractual expectations around confidentiality, encryption, authentication, and audit trails. The document can be adapted for procurement, vendor onboarding, healthcare records handling, and IT change control processes.

Why a Security Information Document Matters for Risk and Compliance

A well-prepared Security Information Document clarifies obligations, reduces ambiguity in incident response, and supports regulatory compliance by recording technical and organizational safeguards.

Typical Users and Signers

Use this document as a shared baseline so technical, legal, and operational teams can confirm expectations before work begins.

Security and IT teams responsible for technical controls and evidence of encryption, access controls, and logging.
Legal and compliance teams that assess contractual language, regulatory obligations, and retention terms.
Procurement and vendor management teams that need documented assurances before onboarding suppliers.

Who Signs and What Their Roles Mean

Security Officer

A named security officer or CISO-level signatory confirms the stated technical controls and incident procedures are accurate and will be maintained during the contract term.

Authorized Executive

An authorized executive (procurement, general counsel, or VP operations) verifies contractual commitments and accepts the business risk associated with the documented security posture.

Core Security Assertions to Include

Encryption: TLS 1.2/1.3 in transit

Data at Rest: AES‑256 encryption

Certifications: SOC 2 Type II

Standards: ISO 27001 certified

Regulatory: HIPAA (BAA required)

Auditability: Detailed audit trail

Key Sections Every Professional Security Information Document Should Contain

A complete Security Information Document typically covers responsibilities, technical controls, access management, incident response, third‑party expectations, and record retention.

Responsibilities

Define which party is responsible for monitoring, patching, and reporting security events, including contact points and escalation paths.

Technical Controls

List encryption standards, authentication methods, network segmentation, backup schedules, and acceptable cryptographic protocols.

Access Management

Describe identity proofing, least privilege model, MFA requirements, and user provisioning/deprovisioning timelines.

Incident Response

Specify notification timelines, forensic access, evidence preservation, and roles for communication to regulators and affected parties.

Third‑Party Terms

Document subprocessor use, subcontractor obligations, and any restrictions on onward transfers or cross‑border data flows.

Retention

State retention periods, secure disposal methods, and legal holds that override normal deletion schedules.

Step-by-Step: How to Complete a Security Information Document

Follow a consistent sequence to gather accurate information, verify technical controls, and route approvals.

01

Gather Parties: Identify all contracting parties and responsible departments
02

Inventory Data: List categories of data covered and sensitivity levels
03

Record Controls: Document encryption, access, and monitoring measures
04

Obtain Approvals: Route to security, legal, and executive signatories

Configuring an Online Workflow for the Security Information Document

Set up a clear signing and approval sequence to reduce delays and ensure each verifier sees only relevant sections.

Field	Configuration
Signer Order	Sequential approval: security → legal → executive
Authentication	Email link + optional SMS code for high risk
Conditional Fields	Show breach contact only if incident response required
Audit Capture	Enable IP, timestamp, and action logging

Where to File or Deliver the Completed Document

Decide repository and distribution channels before signing so post-signature custody and access are clear.

Contract Repository: Upload final signed copy to central contract management
Security Folder: Store redacted technical details in restricted security directories
Vendor Portal: Provide vendors access if they must maintain evidence
Regulatory Filings: File required disclosures with the appropriate agency where applicable

Delivery and eSubmission Options for Security Information Documents

Confirm platform compatibility with your retention policy, BAA needs, and integration points before finalizing workflows.

Cloud Storage: PDF, DOCX storage with access controls
eSignature Platform: Supports TLS, AES, audit trail
Integrations: Salesforce, NetSuite, Google Workspace

Timing Considerations and Common Deadlines

Certain dates and regulatory timelines affect when the Security Information Document must be available and how long it must be retained.

Effective Date:

Date controls when obligations begin

Retention Start:

Retention begins on the Effective Date

Incident Notices:

Regulators often require prompt notification timelines

Periodic Review:

Schedule annual control reviews at minimum

Contract Renewal:

Update document at renewal or material change

Key Milestones from Draft to Archived Record

Track milestones so content, approvals, and retention triggers are auditable and repeatable across contracts.

01

Draft Created

Initial technical and legal inputs collected and recorded

02

Internal Review

Security and legal validate controls and clauses

03

External Approval

Counterparty review and negotiated changes resolved

04

Signed and Filed

Final signatures captured and copies uploaded to repositories

Common Mistakes to Avoid

Failing to name a single responsible party for incident handling
Using vague control descriptions instead of specific standards
Not matching entity legal names across documents
Omitting retention or deletion procedures tied to regulatory rules

Consequences of Incomplete or Incorrect Security Information Documents

Regulatory Fines: Potential HIPAA penalties and corrective action

Contractual Liability: Breach of contract claims and damages exposure

Operational Risk: Delayed incident response and remediation

Data Breach Costs: Notifications, forensics, and remediation expenses

Insurance Gaps: Coverage denial for inadequate controls

Reputational Harm: Loss of customer trust and business

Practical Tips for Accurate, Efficient Completion

Adopt standard templates and a single source of truth to reduce variation and speed approvals.

Use a Standard Template

A consistent template reduces review cycles and supports automation

Pre‑Populate Known Fields

Populate party names, addresses, and standard control descriptions from trusted records

Limit Free‑Text

Structured fields reduce ambiguity and simplify audits

Schedule Periodic Reviews

Annual reviews ensure controls and contact information remain current

Industry Examples Showing How the Document Is Used

Real-world uses show how the Security Information Document adapts across contexts and the consequences of well-documented controls.

Real Estate Vendor Onboarding

A property manager documented vendor access controls and encryption requirements

Reduced onboarding questions by centralizing technical answers
The result was faster vendor approval cycles and clearer contractual obligations across dozens of properties.

Healthcare Data Exchange

A clinic recorded HIPAA safeguards and BAA terms

Explicitly listed breach notification timelines
This provided auditors with a single source of truth and simplified compliance reviews during audits.

Comparing eSignature Options for Security Information Documents

The table compares basic pricing and common capabilities for typical eSignature vendors. Choose a plan that fits volume, compliance, and integration needs.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor and plan options	Varies by vendor and plan options	Varies by vendor and plan options	Varies by vendor and plan options
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About Security Information Documents

Answers to common practical and legal questions to help avoid execution errors and comply with U.S. electronic signature law.

Need help? Contact support

Are electronic signatures valid for this document?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA, electronic signatures are generally legally equivalent to handwritten signatures, except where federal or state law creates an explicit exception.
Do I need a notary for the Security Information Document?
Not always. Notarization depends on the document purpose and state recording requirements. If a deed, power of attorney, or other record requires a notary, follow state-specific rules.
What authentication level is required?
Choose authentication based on risk: email-only for low risk, SMS or knowledge‑based verification for moderate risk, and multi-factor or certified signatures for high risk or regulatory needs.
How long must I retain the document?
Retention depends on the type of records: follow federal minima (e.g., IRS three years, HIPAA six years) and extend retention where contract, state law, or industry rules require longer periods.
Can I use a third party to store signed copies?
Yes, provided the vendor meets your security and contractual requirements. Ensure encryption at rest and transit, and that access controls and audit logs meet your compliance needs.
What happens if a party's legal name is wrong?
Name mismatches can create enforceability or acceptance issues. Correct errors before signature or use an amendment signed by all parties to avoid disputes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now