Can this form be signed electronically?

Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure intent, consent, attribution, and retention requirements are met for validity.

Does the form need a BAA for PHI?

If the form collects or transmits protected health information, a Business Associate Agreement is required under HIPAA and must be in place before electronic processing of PHI; include minimum safeguards and retention clauses.

Are notarization or witnesses required?

Most routine security authorization forms do not require notarization or witnesses. Check state rules where execution is intended; some states require notary acknowledgment for certain legal instruments or when statutes specify.

How should I correct errors after signing?

Corrections typically require re-execution or an amendment signed by the same authorized parties; document the change with dated notes and maintain previous versions for audit trails and evidentiary purposes.

Where should signed forms be stored?

Store signed forms in a secure, access-controlled repository with encryption and an audit trail. Ensure retention policies meet federal and industry rules such as IRC §6501(a) for tax records or 45 CFR §164.530(j) for HIPAA records.

Who is authorized to sign the form?

Typically an employee with hiring, provisioning, or contracting authority signs on behalf of an employer; vendors must designate an authorized representative. Note internal delegation policies and any contractually required signatory limits.

Electronic Signature
Templates
Miscellaneous
Security Information Form

Security Information Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Security Information Form

Client Name: Service Provider Name:

Agreement Date:

Whereas

WHEREAS, Client Name: seeks to establish and document security information, access controls, and related services for specified premises and systems; and

WHEREAS, Service Provider Name: has the expertise to perform security services, collect security information, and implement access and data-protection measures in accordance with this form and agreement; and

WHEREAS, the parties desire to record the scope of work, security information collected, payment terms, confidentiality obligations and other contractual terms governing the security engagement.

Scope of Work

The Service Provider will perform the security services, assessments and information collection described below. The parties agree that the scope may include physical security assessments, logical access provisioning, background screening coordination, badge issuance, security training, incident response planning, and the collection of system and personnel security data necessary to perform such services.

Describe Scope of Work:

Security Information Collected

Primary Security Contact Name: Title / Role: Phone and Email: Office Address: Access Requirements (check all that apply):

Physical site access (badges, escorts)
Logical/network access (accounts, VPN)
Remote administrative access
Limited/time-bound access

Background Checks & Training

Background checks required: Yes Date completed:

Security training completed: Yes Training date:

Badge / Credential ID: Equipment / Credentials Issued (list):

Data Protection & Retention

The Service Provider shall implement reasonable administrative, technical and physical safeguards to protect security information collected under this form, including encryption in transit and at rest where applicable, access logging, and role-based access controls. The Service Provider will only retain collected security information for the period necessary to perform the services or as required by law.

Describe data protection measures and retention period:

Payment Terms

Client agrees to pay Service Provider for services performed under this form in accordance with the terms below. Invoices shall state the scope performed and amounts due. Unless otherwise agreed in writing, payment is due within the period specified below after invoice date.

Amount: Payment Schedule / Terms: Late Fee / Interest:

Term and Termination

This agreement shall commence on Start Date and, unless earlier terminated as permitted below, shall continue through End Date. Either party may terminate for convenience upon providing the required notice period set forth below. Termination shall not relieve either party of accrued payment obligations or obligations that by their nature survive termination.

Start Date: End Date: Notice Period for Termination:

Confidentiality

Each party acknowledges that security information, personnel data, access credentials, vulnerability assessments and any findings, reports or deliverables produced pursuant to this form constitute Confidential Information. The receiving party shall (a) use Confidential Information solely to perform under this form, (b) restrict disclosure to employees, subcontractors or agents who have a need to know and are bound by confidentiality obligations no less protective than those herein, and (c) employ commercially reasonable measures to safeguard Confidential Information. Confidentiality obligations shall survive termination for a period of five (5) years or as otherwise required by applicable law with respect to certain categories of personal data.

Governing Law

This form and any dispute arising out of or related to it shall be governed by and construed in accordance with the laws of the state of , without regard to conflict-of-law principles.

Entire Agreement

This Security Information Form, together with any attachments, exhibits and referenced schedules, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations and discussions, whether oral or written. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

Representations and Certifications

Each party represents that it has authority to enter into this form, that the information provided herein is accurate to the best of its knowledge, and that it will comply with applicable laws and regulations in the performance of its obligations.

Client Name:

By:

Date:

Service Provider Name:

By:

Date:

What the Security Information Form Is and why it matters

The Security Information Form is a standardized record used to capture authoritative details about individuals, vendors, systems, or contracts that require controlled access to sensitive assets. It typically collects identity and contact information, role-based access and permissions, security certifications or clearances, technical controls assigned, and incident contact points. Organizations use the completed form to authorize access, document approvals, support audits, and demonstrate compliance with applicable federal and industry obligations. The form can be issued on paper or electronically and must be retained according to applicable retention rules.

Why using a Security Information Form reduces ambiguity

The Security Information Form centralizes evidence of authorization, access, and security controls, supporting audits, vendor assessments, and incident response. Properly completed forms reduce ambiguity about responsibilities and provide a documented chain of custody for access decisions and compliance reviews.

Who completes and relies on the form

Typical users and signers include internal and external stakeholders who manage or require access to sensitive systems.

IT administrators and security engineers who assign roles, configure permissions, and review access attestations on a periodic basis.
Vendors and contractors that require system access; they provide certifications, insurance details, and designated points of contact.
Compliance, privacy, and HR teams that collect records for audits, background checks, and regulatory reporting.

Use the form consistently across units to simplify review cycles and maintain a single source of truth for security attributes.

Core sections every professional Security Information Form should include

Essential sections of a professional Security Information Form ensure clarity, traceability, and alignment with compliance and operational controls and support automated workflows.

Identity

Collect full legal name, government ID type and number when required, corporate registration details for organizations, and any unique identifier used for system access tracking.

Contact Info

Provide mailing and email addresses, direct phone numbers, emergency contacts, and preferred communication channels for incident notifications and security escalations.

Role & Access

Describe job function, role-based access levels, systems and data categories accessible, and approval authority including dates and authorizing manager or department.

Certifications

Record relevant certifications, background check results, security training completion dates, clearance levels, and expiration dates where applicable.

Controls

Document technical controls assigned (MFA, VPN, encryption), required endpoint configurations, and any segregation of duties or privileged access constraints.

Incident Contacts

List primary and secondary points of contact for security incidents, escalation steps, expected response SLAs, and notification requirements to external parties.

Security and compliance data elements to capture

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Authentication: MFA required where privileged access is granted

Access Level: Least-privilege role with documented justification

Clearance Level: Designated clearance or background check level

Expiration Dates: Certificate and access expiry dates

Audit Trail: Timestamped audit trail and signed logs

Step-by-step: complete and validate the form

Follow the sequential steps below to complete, verify, and store the Security Information Form accurately and efficiently for auditing.

01

Prepare: Gather ID, approvals, and supporting documents.
02

Complete: Fill all required fields with MM/DD/YYYY formats.
03

Authorize: Obtain manager or contracting officer signature.
04

Record: Archive signed copy and update access records.

Typical routing and recipients for the completed form

This routing shows typical destinations and recipients for the completed Security Information Form in organizational workflows.

Sender: Security officer or procurement initiates and uploads form.
Reviewer: IT and compliance teams review access and controls.
Signer: Authorized manager signs to grant or deny access.
Repository: Store in secure records system with audit logging.

Configuring an online workflow for the form

Configure an online workflow to automate routing, approvals, and retention for the Security Information Form.

Field	Configuration
Authentication Method	Email link, SMS code, or KBA as needed
Conditional Fields	Show controls only when vendor or privileged access selected
Retention Tags	Auto-apply retention policy based on document type
Notifications	Email and Teams alerts for pending approvals

Digital submission, formats, and integrations

Digital submission requires compatible file formats, secure transport, and signer authentication options.

Formats: PDF, DOCX, and fillable templates supported
Integrations: Salesforce, Microsoft 365, Google Workspace, NetSuite
Security: TLS 1.2/1.3 and AES-256 encryption

Timing: common deadlines and update triggers

Typical timing and deadlines when issuing or updating a Security Information Form within organizational processes.

Upon Access Request:

Provide form before access is granted; tie to provisioning actions.

Annual Review:

Reconfirm access and controls at least once per year.

After Role Change:

Update within 5 business days of role or responsibilities change.

Incident Update:

Submit updated form within 48 hours after security incidents.

Retention Trigger:

Retention begins at effective date or termination, per policy.

Common preparation errors to avoid

Incomplete or inconsistent names that do not match government IDs or vendor registrations leading to failed identity verification and access delays.
Using ambiguous access descriptions instead of explicit role names causes misconfiguration and unauthorized privilege escalation risks.
Failing to record approval dates and authorizing manager details prevents auditability and weakens compliance posture.
Not aligning retention tags with regulatory requirements results in premature deletion or excessive retention exposing legal risk.

Consequences of incorrect or missing information

Regulatory Fines: HIPAA and state penalties possible

Access Violations: Unauthorized access and data exposure risk

Contract Breach: Vendor noncompliance triggers contractual remedies

Reputational Harm: Customer trust erosion and business loss

Operational Disruption: Service outages from improper access

Audit Findings: Negative findings and remedial costs

eSignature vendor comparison for Security Information Form workflows

Compare common eSignature vendors for cost, bulk send, audit capabilities, and HIPAA suitability when selecting a platform for Security Information Form workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about the Security Information Form

Answers address common legal, technical, and operational questions to help you complete, sign, and store Security Information Forms correctly.

Need help? Contact support

Can this form be signed electronically?
Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure intent, consent, attribution, and retention requirements are met for validity.
Does the form need a BAA for PHI?
If the form collects or transmits protected health information, a Business Associate Agreement is required under HIPAA and must be in place before electronic processing of PHI; include minimum safeguards and retention clauses.
Are notarization or witnesses required?
Most routine security authorization forms do not require notarization or witnesses. Check state rules where execution is intended; some states require notary acknowledgment for certain legal instruments or when statutes specify.
How should I correct errors after signing?
Corrections typically require re-execution or an amendment signed by the same authorized parties; document the change with dated notes and maintain previous versions for audit trails and evidentiary purposes.
Where should signed forms be stored?
Store signed forms in a secure, access-controlled repository with encryption and an audit trail. Ensure retention policies meet federal and industry rules such as IRC §6501(a) for tax records or 45 CFR §164.530(j) for HIPAA records.
Who is authorized to sign the form?
Typically an employee with hiring, provisioning, or contracting authority signs on behalf of an employer; vendors must designate an authorized representative. Note internal delegation policies and any contractually required signatory limits.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now