Can a checklist be signed electronically?

Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states when intent, consent, attribution, and record retention are demonstrable.

Do I need a BAA for health data?

If the checklist contains protected health information or the vendor handles PHI, execute a Business Associate Agreement (BAA) to meet HIPAA compliance obligations.

What authentication level is sufficient?

Choose an authentication method proportional to risk. Email-only may suffice for low-risk items; require MFA, SMS code, or stronger verification for high-risk or regulated assessments.

How should evidence be stored?

Store signed checklists and supporting evidence in encrypted, access-controlled storage with an immutable audit trail to satisfy audit and retention requirements.

Are remote notarizations accepted?

Remote Online Notarization is accepted in many states subject to state rules; verify state-specific RON status before relying on a remote notarization.

What happens if names don’t match?

Mismatched signer names or missing attribution can weaken legal enforceability; correct and re-sign or provide identity documentation and an attestation before final acceptance.

Electronic Signature
Templates
Miscellaneous
Security Review Checklist

Security Review Checklist

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Security Review Checklist and Service Agreement

Parties and Recitals

This Security Review Checklist and Service Agreement ("Agreement") is entered into by and between:

Client Name: Service Provider Name:

WHEREAS, Client engages Provider to perform a security review of Client systems, applications, and controls; and

WHEREAS, Provider represents that it possesses the necessary skill, experience and personnel to perform such review in accordance with accepted professional information security practices; and

WHEREAS, the parties wish to document the scope, deliverables, payment terms and the checklist of security controls to be assessed.

Scope of Work

Provider shall perform a security review consisting of the assessment items listed below and produce a summary report describing findings, risk ratings, and recommended remediations. The review will include interviews, testing, and documentation review as necessary to evaluate controls in scope.

Detailed Scope (describe systems, networks, environments, and exclusions):

Security Assessment Checklist

Reviewer Information

Reviewer Name: Reviewer Title / Role:

Review Date:

Assessment Items

Physical access controls (site access, badge, locks)

Network security (firewalls, segmentation, IDS/IPS)

Application security (secure coding, testing, OWASP controls)

Access control and identity management (roles, least privilege)

Incident response readiness (playbooks, escalation, logging)

Backup and recovery (backup schedule, restoration testing)

Configuration management and patching

Data protection and encryption (data at rest/in transit)

Third-party risk management (vendor assessments, contracts)

Findings, Risk Rating and Remediation

For each deficiency identified, provide a concise finding, assign a risk rating, identify the responsible party and target remediation date.

Finding 1 - Brief Description:

Risk Rating: Responsible Party: Target Remediation Date:

Remediation Plan and Notes: Finding 2 - Brief Description:

Risk Rating: Responsible Party: Target Remediation Date:

Remediation Plan and Notes:

Payment Terms

Compensation for the security review services will be paid in accordance with the following terms.

Total Fee (USD): Payment Schedule: Late Payment Fee:

Term and Termination

This Agreement commences on Start Date and continues until End Date unless sooner terminated in accordance with this section.

Start Date: End Date:

Termination Notice Period (days):

Confidentiality

Each party shall maintain in confidence all Confidential Information received from the other party during the term of this Agreement and for a period of three (3) years thereafter. Confidential Information includes nonpublic technical, business, security, and operational information. Confidential Information shall not include information that is (a) publicly known without breach; (b) rightfully received from a third party without restriction; or (c) independently developed without use of Confidential Information.

Provider will not perform intrusive exploitative testing or exfiltrate data unless expressly authorized in writing; any authorized destructive testing must be agreed in advance and documented in the scope.

Governing Law

This Agreement will be governed by and construed in accordance with the laws of the jurisdiction specified by the parties below, without reference to conflict of law principles.

Governing Law Jurisdiction:

Entire Agreement

This Agreement constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral, relating to the security review described herein. Any modification must be in writing and executed by authorized representatives of both parties.

Certification and Acknowledgments

The undersigned reviewer certifies that the checklist items were evaluated to the best of their professional ability and that findings recorded in this form and any attached report reflect information available at the time of the review. Client acknowledges that security testing has inherent limitations and no assessment can guarantee the absence of vulnerabilities.

Additional Comments:

Client Name:

By:

Date:

Service Provider Name:

By:

Date:

What the Security Review Checklist Is and When it Applies

A Security Review Checklist is a structured document used to evaluate an application, vendor, process, or system against defined security controls and compliance requirements. It captures factual information about architecture, data flows, authentication, encryption, incident response procedures, and any regulatory considerations. Organizations use the checklist to document scope, identify gaps, assign remediation tasks, and produce a record that supports audits and vendor risk management. For U.S.-centric compliance, entries commonly reference ESIGN/UETA for electronic records, HIPAA for protected health information, and industry-specific controls tied to the assessment scope.

Why a Security Review Checklist Matters

A checklist standardizes risk evaluation, preserves evidence for audits, and reduces omissions during assessments.

Who Typically Completes the Security Review Checklist

Security, procurement, and compliance teams commonly initiate and complete these assessments before procurement or deployment.

Information Security Teams — Security engineers and risk analysts perform technical validation and document controls.
Procurement and Vendor Risk — Procurement owners capture third-party assertions and contract requirements.
Compliance and Legal — Compliance officers confirm regulatory clauses and retention requirements.

Final sign-off usually comes from the designated owner who has authority to accept residual risk.

Essential Security and Compliance Data to Capture

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Authentication: MFA, SSO, and role-based access controls

Certifications: SOC 2 Type II, ISO 27001, PCI DSS

Regulatory Support: ESIGN, UETA, HIPAA (BAA required)

Audit Trail: Immutable timestamps and action history

Accessibility: WCAG 2.0 Level AA compliance

Step-by-Step: Completing the Security Review Checklist

Follow a consistent sequence: define scope, collect evidence, assess controls, record findings, assign remediation, and sign off.

01

Define Scope: List systems and data flows in scope.
02

Collect Evidence: Attach architecture diagrams and configuration screenshots.
03

Assess Controls: Evaluate each control against documented criteria.
04

Assign Remediation: Record owner, priority, and a due date.

How to Configure an Online Security Review Workflow

Configure templates, conditional fields, and authentication to match your risk and compliance profile before sending.

Field	Configuration
Template	Create reusable checklist template with fixed sections
Conditional Logic	Show fields only when relevant to reduce signer friction
Authentication	Require email, SMS code or stronger verification
Integrations	Connect to SIEM, ticketing, or GRC systems

Technical Requirements for Digital Completion

Ensure the platform supports secure uploads, audit trails, and preferred authentication methods before use.

Integrations: Salesforce, NetSuite, Google Workspace supported
File Formats: PDF, DOCX, and HTML accepted
Authentication: Email, SMS, or advanced options

Confirm the platform aligns with your retention policy and any industry compliance needs such as HIPAA or 21 CFR Part 11 before eSubmission.

Where to Send or File the Completed Checklist

Route completed checklists to the appropriate stakeholders and archival systems based on your internal retention policy.

Security Team: Primary repository for findings and remediation tracking
Vendor Management: Store third-party evidence and contracts
Legal / Compliance: Retain final signed copies and audit certificates
Archived Storage: Long-term retention in encrypted storage

Common Preparation Mistakes to Avoid

Incomplete scope definitions that omit cloud services or third-party subcontracts can leave significant security gaps undiscovered and unmitigated.
Using inconsistent status tags or free-form findings makes it difficult to aggregate results and prioritize remediation across multiple assessments.
Failing to attach source evidence such as logs, config files, or screenshots leads reviewers to request clarifications and delays closure.
Relying on verbal confirmations instead of documented controls and signed attestations undermines auditability and regulatory defensibility.

Consequences of an Incorrect or Incomplete Checklist

Regulatory Fines: HIPAA violations risk civil penalties

Tax Penalties: Incorrect filings trigger IRS fines

Operational Risk: Unremediated gaps increase breach likelihood

Contractual Liability: Vendor breaches can lead to damages

Audit Failure: Missing evidence may fail audits

Reputational Harm: Public breaches damage trust

eSignature Pricing and Feature Comparison

Comparison of starting prices and select features across major providers. signNow is listed first per platform conventions; verify plan specifics with each vendor.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Available (Business Premium)	Varies	Varies	Varies	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Varies	Varies	Varies	Varies
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Practical Tips for Accurate and Efficient Completion

Apply consistent standards and automate where possible to reduce review time and improve data quality across assessments.

Standardize Templates

Use a single, approved checklist template for similar assessments and maintain version control. This prevents omissions and supports consistent audit trails across vendors and business units.

Attach Source Evidence

Include diagrams, configuration screenshots, and log snippets for each finding. Defensible evidence reduces follow-up queries and supports auditors reviewing remediation effectiveness.

Enforce Ownership

Assign a single remediation owner per finding with clear due dates and priority levels. Track status in a centralized system to avoid duplicated work and missed closures.

Use Strong Authentication

Require multi-factor or equivalent signer verification for sensitive assessments. Strong authentication strengthens attribution and aligns with 21 CFR Part 11 or HIPAA expectations where applicable.

Typical Timelines and Processing Expectations

Define internal SLAs so stakeholders know expected turnaround times for each phase of the review.

Initial Submission:

Within 5 business days of request

Technical Assessment:

10–15 business days depending on scope

Remediation Window:

30–90 days based on severity

Final Sign-off:

After remediation verification and evidence review

Archival:

Store signed record per retention policy

Key Milestones Through the Security Review Process

Use this sequence to communicate progress: intake, assessment, remediation, verification and closure.

01

Intake and Scoping

Collect basic asset and vendor information and define assessment boundaries.

02

Technical Assessment

Perform control testing, evidence collection, and document findings.

03

Remediation

Owners implement fixes and update status in tracking system.

04

Verification and Closure

Validate remediation, obtain final signatures, and archive the record.

Frequently Asked Questions About the Security Review Checklist

Answers to common questions on scope, signatures, legal validity, and handling of evidence during security reviews.

Need help? Contact support

Can a checklist be signed electronically?
Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states when intent, consent, attribution, and record retention are demonstrable.
Do I need a BAA for health data?
If the checklist contains protected health information or the vendor handles PHI, execute a Business Associate Agreement (BAA) to meet HIPAA compliance obligations.
What authentication level is sufficient?
Choose an authentication method proportional to risk. Email-only may suffice for low-risk items; require MFA, SMS code, or stronger verification for high-risk or regulated assessments.
How should evidence be stored?
Store signed checklists and supporting evidence in encrypted, access-controlled storage with an immutable audit trail to satisfy audit and retention requirements.
Are remote notarizations accepted?
Remote Online Notarization is accepted in many states subject to state rules; verify state-specific RON status before relying on a remote notarization.
What happens if names don’t match?
Mismatched signer names or missing attribution can weaken legal enforceability; correct and re-sign or provide identity documentation and an attestation before final acceptance.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now