Can the form be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided intent, consent, attribution, and record retention are met.

When is a notarized or witnessed signature required?

Notarization is rarely required for technical reports but may be contractually mandated; check governing agreements and state rules if a sworn statement is needed.

How should evidence be attached?

Attach native exports or PDFs of logs, tool output, and screenshots. Preserve timestamps and include a short explanation of each attachment for traceability.

Who should sign the completed report?

At minimum, the lead tester, the system owner, and a compliance reviewer should sign to acknowledge findings and remediation ownership.

How long must reports be retained?

Retain reports per the strictest applicable requirement—commonly 3–7 years; healthcare-related records require 6 years under 45 CFR §164.530(j).

Can third-party testers use their own template?

Yes, but ensure their template captures authorization, scope, evidence, remediation, and signature blocks required by your policies and contracts.

Electronic Signature
Templates
Miscellaneous
Security Intrusion Tests Form

Security Intrusion Tests Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Security Intrusion Tests Form

Recitals

WHEREAS, Client Name: and Client Address:

WHEREAS, Service Provider: and Provider Address:

WHEREAS, Client engages Service Provider to perform controlled security intrusion tests (the "Services") as described below, and Service Provider accepts such engagement under the terms and conditions set forth in this form.

Point(s) of Contact

Client Contact Service Provider Contact

Scope of Work

The Service Provider shall perform security intrusion testing in accordance with the scope described below. Tests may include exploitation of vulnerabilities, simulated attacks and other intrusive techniques expressly authorized herein. Client grants permission for the tests and acknowledges potential service impacts.

Detailed Scope of Work Types of Tests Authorized (check all that apply)

External penetration test
Internal penetration test
Web application assessment
Social engineering / phishing
Physical security assessment

Systems In Scope Exclusions and Constraints Authorized Test Window

Start Date: End Date:

Tools, Credentials and Access

Payment Terms

Client agrees to pay Service Provider the fees described below in exchange for the Services rendered. Unless otherwise agreed in writing, all amounts are due in United States dollars.

Total Fee Payment Schedule Late Fee

Late payment shall accrue interest at per month on outstanding amounts, or the maximum permitted by law, whichever is less.

Term and Termination

This Agreement commences on Start Date: and ends on End Date: , unless earlier terminated as provided below.

Either party may terminate for convenience by providing written notice at least days prior to the intended termination date. Termination for material breach may be immediate where the breach is not cured within a reasonable cure period specified in written notice.

Confidentiality

Each party shall treat as confidential all non-public information disclosed by the other party in connection with the Services ("Confidential Information"). Confidential Information shall not include information that: (a) is or becomes publicly known through no breach of this Agreement; (b) is lawfully received from a third party without restriction; or (c) is independently developed without use of the disclosing party's Confidential Information.

Receiving party shall use Confidential Information solely to perform its obligations under this Agreement and shall restrict disclosure to employees, contractors or advisors who have a need to know and are bound by confidentiality obligations no less protective than those herein.

Acknowledgement: Client and Service Provider acknowledge and agree to the confidentiality obligations set forth above.

Data Handling and Incident Procedures

Service Provider will segregate and protect Client data and shall not exfiltrate sensitive data beyond what is necessary for testing and reporting. Retention of any Client data collected during testing shall not exceed days unless agreed in writing.

Incident Notification Procedure

Liability, Indemnity and Insurance

Service Provider shall perform Services with commercially reasonable care. Except for willful misconduct or gross negligence, Client releases Service Provider from liability for incidental disruptions to services resulting directly from authorized testing. Service Provider's aggregate liability for direct damages arising out of or related to the Services shall be limited to the total fees paid by Client under this Agreement.

Client agrees to indemnify and hold harmless Service Provider for third-party claims arising from Client's failure to obtain required consents, misrepresentation of scope, or Client-directed actions outside the agreed scope. Service Provider shall maintain professional liability insurance in amounts customary for the industry; specific limits may be requested and agreed in writing.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of law principles. Parties consent to the exclusive jurisdiction of the state and federal courts located therein for disputes arising under this Agreement.

Entire Agreement

This form, together with any statements of work or appendices expressly incorporated by reference, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

Representations and Authorizations

Client represents and warrants that it has authority to authorize the tests described herein against the systems and accounts identified, and that such authorization will not violate the rights of any third party. Client expressly authorizes Service Provider to perform the tests described above, including any limited exploitation necessary to validate findings.

Client:

By:

Date:

Service Provider:

By:

Date:

What the Security Intrusion Tests Form Records

The Security Intrusion Tests Form documents authorized security testing activity—scope, test type (penetration test, vulnerability scan, red team exercise), dates, systems tested, tools used, findings, risk ratings, and remediation recommendations. It provides an auditable record for internal security teams, third-party assessors, and compliance reviewers. The form supports accountability by naming the test operator, the client or system owner, and the reviewer responsible for validating remediation, and it can be retained as part of incident response, vendor due diligence, or regulatory evidence.

Why a Formal Intrusion Test Report Matters

A standardized Security Intrusion Tests Form centralizes evidence, demonstrates due diligence to regulators and customers, and clarifies remediation responsibilities. Proper documentation helps meet legal and contractual obligations and supports internal audit trails consistent with electronic record rules such as the ESIGN Act (15 U.S.C. ch. 96) and state UETA provisions.

Who Typically Completes and Reviews This Form

Sign-off is often required from both the system owner and a compliance or security manager to close the testing loop.

Internal security teams and SOC managers who schedule and review tests and assign remediation tasks.
Third-party penetration testers and managed security service providers documenting scope, methods, and proof of findings.
Compliance, legal, and risk teams who need documented evidence for audits and customer inquiries.

Essential Sections to Include on the Form

A professional Security Intrusion Tests Form groups data for clarity: authorization, scope, test activities, findings, remediation, and signatures. Each section should be concise and evidence-linked.

Authorization

Documented permission from system owner, date authorized, and any restrictions on testing methods or hours.

Scope

Systems, IP ranges, applications, and data classifications in scope, plus out-of-scope assets to limit liability and focus testing.

Test Method

High-level description of techniques used (manual testing, automated scans, exploit attempts) and tools or versions employed for reproducibility.

Findings

Clear vulnerability descriptions, CVE references if applicable, reproducible steps, screenshots or logs, and initial risk ratings.

Remediation

Recommended fixes, assigned owners, priority levels, and target remediation dates to track closure.

Signatures

Designated signers (tester, system owner, reviewer), dates, and eSignature or notarization details where required.

Data Points the Form Should Capture

Test Date: MM/DD/YYYY

Tester: Name and company

Scope Summary: Assets and limits

Risk Rating: Low / Medium / High

Evidence: Logs/screenshots

Remediation Due: MM/DD/YYYY

Step-by-Step: Complete the Form Accurately

Follow these sequential steps to ensure the form is complete, auditable, and actionable.

01

1. Record authorization: Enter approver name, role, and authorization date.
02

2. Define scope: List target hosts, networks, and explicit exclusions.
03

3. Log activities: Note tools, commands, and timestamps for each test action.
04

4. Assign remediation: Specify owner, priority, and target closure date.

How to Configure an Online Testing Form Workflow

Set up a digital workflow that enforces required fields, routes to reviewers, and stores an immutable audit trail.

Field validation	Require authorization, scope, and evidence attachments before submission
Routing rules	Auto-send to system owner then to compliance reviewer
Authentication	Use email plus SMS or SSO for stronger signer identity
Attachments	Allow PDF, PNG, TXT, and log file uploads
Retention policy	Enforce minimum retention per compliance schedule

Typical Submission and Review Flow

A clear arrowed process reduces missed steps and preserves evidence needed for audits and vendor management.

Initiate: Tester uploads form and evidence
Authorize: System owner reviews and approves
Validate: Compliance or security reviewer checks findings
Close: Remediation confirmed and form signed

Digital Signing and Platform Requirements

Ensure signer authentication matches risk (email, SMS, KBA, or advanced methods) and that the platform supports exports in PDF/A with embedded audit metadata.

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest
Audit Trail: Timestamps, IP addresses, and action logs
Compliance: HIPAA BAA option and SOC 2 Type II available

Key Timelines and Expected Turnarounds

Set and communicate clear deadlines so remediation and retesting occur within acceptable windows.

Initial test window:

Dates when active testing takes place

Report delivery:

Typically within 3–10 business days after testing

Remediation due:

Owner-specified target date (commonly 30–90 days)

Retest window:

Retest once fixes are deployed, commonly within 7–30 days

Record retention:

Keep reports per retention policy (see retention timeline)

Common Mistakes to Avoid When Preparing the Form

Missing authorization or out-of-scope assets can create legal exposure and invalidate test results.
Insufficient evidence (no logs or screenshots) makes findings unverifiable and delays remediation.
Undefined remediation owners or vague due dates lead to unresolved vulnerabilities and audit findings.
Using inconsistent risk ratings across reports causes confusion for stakeholders and slows prioritization.

Consequences of Incomplete or Incorrect Documentation

Regulatory exposure: Possible enforcement or corrective actions for inadequate controls

Contract breaches: Supplier or customer contracts may require documented testing

Insurance issues: Incomplete records can jeopardize cyber insurance claims

Failed audits: Internal or external audits may report noncompliance

Operational risk: Undetected vulnerabilities increase breach likelihood

Reputational harm: Public disclosure of testing missteps can harm trust

Representative eSignature Pricing and Capabilities

Comparison of typical starting prices and key capabilities for common eSignature vendors; signNow is listed first per vendor ordering rules.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Practical Examples of How the Form Is Used

Two concise scenarios show typical uses and outcomes for documented intrusion testing.

Hospital IT Example

A hospital schedules an authorized penetration test to assess EHR interfaces.

Tester documents vulnerabilities with logs and screenshots.
The form records remediation owners and timelines and supports the hospital's HIPAA compliance review and post-test audit trail.

SaaS Vendor Example

A SaaS provider commissions a third-party red team to test customer tenant isolation.

Findings include exploit steps and evidence exports.
The completed form is stored with contract records, used to demonstrate due diligence to customers and to prioritize engineering fixes.

FAQs and Troubleshooting for the Security Intrusion Tests Form

Answers to frequent questions about signing, storage, and legal considerations for intrusion test documentation.

Need help? Contact support

Can the form be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, provided intent, consent, attribution, and record retention are met.
When is a notarized or witnessed signature required?
Notarization is rarely required for technical reports but may be contractually mandated; check governing agreements and state rules if a sworn statement is needed.
How should evidence be attached?
Attach native exports or PDFs of logs, tool output, and screenshots. Preserve timestamps and include a short explanation of each attachment for traceability.
Who should sign the completed report?
At minimum, the lead tester, the system owner, and a compliance reviewer should sign to acknowledge findings and remediation ownership.
How long must reports be retained?
Retain reports per the strictest applicable requirement—commonly 3–7 years; healthcare-related records require 6 years under 45 CFR §164.530(j).
Can third-party testers use their own template?
Yes, but ensure their template captures authorization, scope, evidence, remediation, and signature blocks required by your policies and contracts.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now