Is an e-signed supplement legally binding?

Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are generally enforceable provided intent, consent, attribution, and record retention requirements are met.

Do I need a BAA for HIPAA-covered data?

Yes. If the supplement governs handling of Protected Health Information, require a Business Associate Agreement and ensure the vendor will sign a BAA and meet 45 CFR §164.530(j) retention and safeguard standards.

When is notarization required?

Most security supplements do not require notarization. If a signature notarization or witness is contractually required, follow the state-specific rules for notarization or RON in the relevant jurisdiction.

What evidence should I accept instead of full audits?

Accept recent SOC 2 Type II reports, ISO 27001 certificates, or third-party penetration test summaries combined with attestations to reduce cost and preserve assurance.

Can I revoke or amend a signed supplement?

A supplement can be amended only by mutual written agreement per the amendment clause. Revocation without consent may be a material breach and can trigger remedies in the underlying contract.

How long should I keep signed supplements?

Retain the executed supplement for the contract term plus at least three years; follow federal and industry retention rules such as IRC §6501(a) and 45 CFR §164.530(j) where applicable.

Electronic Signature
Templates
Miscellaneous
Security Supplement Agreement

Security Supplement Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SECURITY SUPPLEMENT AGREEMENT

This Security Supplement Agreement (the "Supplement") is made effective as of (the "Effective Date") by and between:

Secured Party Secured Party Address Obligor Obligor Address

WHEREAS

WHEREAS, Secured Party and Obligor are parties to a principal agreement identified as the dated (the "Principal Agreement");

WHEREAS, the parties desire to establish, amend, or supplement the security interest, collateral description, and related obligations of Obligor in connection with the Principal Agreement as set forth in this Supplement; and

WHEREAS, the parties intend that this Supplement create and continue a security interest for the benefit of Secured Party and to set forth the respective rights and obligations of the parties regarding such security interest.

SCOPE OF COLLATERAL / SCOPE OF WORK

The collateral subject to the security interest and any supplemental services to be performed by Obligor are described below. The description is intended to identify all tangible and intangible property that will secure Obligor's obligations under the Principal Agreement and this Supplement.

Detailed Description of Collateral and Services

Collateral may include, without limitation, accounts, inventory, equipment, documents, instruments, intellectual property, contract rights, and proceeds thereof. The parties acknowledge that the foregoing description is intended to be broad and shall be interpreted in the manner required to perfect and enforce a security interest under applicable law.

SECURITY INTEREST

Obligor hereby grants to Secured Party a continuing first-priority security interest in the collateral described above and in such additional property as may be necessary to secure all obligations of Obligor arising under the Principal Agreement and this Supplement, whether now existing or hereafter arising. Obligor agrees to execute and deliver financing statements, control agreements, and other instruments reasonably requested by Secured Party to perfect and maintain the security interest.

PAYMENT TERMS

In consideration of the security and services provided under this Supplement, Obligor shall pay to Secured Party the amounts and according to the schedule set forth below.

Total Security Charge / Fee Payment Schedule Late Payment Fee

All amounts due under this Supplement are payable in lawful money of the United States (unless otherwise agreed in writing). If Obligor fails to make any payment when due, Secured Party may declare all obligations immediately due and payable and exercise remedies provided for in this Supplement, the Principal Agreement, and applicable law.

TERM AND TERMINATION

This Supplement shall commence on the Effective Date and shall continue in effect until unless earlier terminated in accordance with this Section.

Notice Period for Termination

Either party may terminate this Supplement for material breach by the other party that remains uncured after the notice period specified above. Termination shall not affect Secured Party's rights to enforce the security interest with respect to obligations incurred prior to termination or to collect sums then due.

CONFIDENTIALITY

Each party shall maintain in strict confidence all non-public information disclosed by the other party in connection with this Supplement, including descriptions of collateral, financial statements, and security documentation ("Confidential Information"). Confidential Information shall not be disclosed except as required by law, to its legal and financial advisors on a need-to-know basis, or with the disclosing party's prior written consent. The confidentiality obligations shall survive termination of this Supplement for a period of three (3) years.

DEFAULT AND REMEDIES

The occurrence of any of the following events shall constitute an Event of Default: (a) failure to pay any amount when due; (b) a material breach of any representation, warranty, or covenant contained in this Supplement or the Principal Agreement; (c) insolvency, bankruptcy, or appointment of a receiver for a party. Upon Event of Default, Secured Party may, to the fullest extent permitted by law, exercise all rights and remedies available under this Supplement, the Principal Agreement, and applicable law, including foreclosure on or disposition of collateral.

GOVERNING LAW

This Supplement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Supplement, together with the Principal Agreement and any documents expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations and discussions, whether oral or written, relating to such subject matter. No amendment or waiver shall be effective unless in writing and signed by both parties.

MISCELLANEOUS PROVISIONS

If any provision of this Supplement is determined to be invalid or unenforceable, the remainder of this Supplement shall remain in full force and effect. The parties agree to execute such further instruments and take such further actions as may be necessary to effectuate the purposes of this Supplement.

Additional Terms or Notes

Secured Party:

By:

Date:

Obligor:

By:

Date:

What the Security Supplement Agreement Covers

A Security Supplement Agreement is a contract addendum that documents specific security obligations, controls, and responsibilities between contracting parties. It typically supplements a master services agreement or vendor contract by specifying technical and administrative safeguards, data handling rules, incident response procedures, encryption and access controls, and compliance requirements such as HIPAA or PCI. The supplement clarifies who owns logs, how breaches are reported, allowed subcontracting, and testing or audit rights. It is used when the underlying agreement requires detailed security measures or when a customer requests documented assurances about handling sensitive data.

Why a Security Supplement Agreement Matters

A Security Supplement Agreement narrows risk by documenting specific controls, evidence, and responsibilities that general contracts omit. It reduces ambiguity about data handling, supports regulatory compliance (for example HIPAA or PCI), and provides clear breach notification timelines and audit rights that both parties can enforce.

Who typically completes a Security Supplement Agreement

Organizations and vendors complete Security Supplement Agreements when services involve handling regulated, sensitive, or proprietary data.

Corporate buyers and procurement teams seeking documented security commitments from vendors.
Third-party service providers (SaaS, hosting, MSPs) that process customer data under contract.
Security, privacy, or compliance officers verifying controls for regulated data.

The agreement is usually reviewed by legal, security, and procurement teams before signature to ensure obligations and remedies align with corporate risk tolerance.

Core components to include in a professional Security Supplement Agreement

A complete supplement groups obligations into clear sections so reviewers can verify controls, measure compliance, and assign remedies without revisiting the main contract.

Scope

Define covered systems, data types, processing activities, environments (production, staging), and any excluded assets so both parties agree what the supplement governs.

Security Controls

List technical and organizational measures such as encryption standards, access controls, MFA, vulnerability management, logging, and secure development lifecycle expectations.

Incident Response

Specify breach notification timelines, escalation procedures, forensic cooperation, regulatory filing responsibilities, and liabilities arising from security incidents.

Audit and Reporting

Describe audit rights, frequency, acceptable evidence (SOC 2, penetration test reports), and the process for remedial action when gaps are identified.

Subprocessors

Require prior notice or approval for subcontractors, maintain a subprocessors list, and mandate flow-down obligations to ensure consistent protections.

Liability and Remedies

Clarify indemnification, limitation of liability carve-outs for breaches, insurance requirements, and contractual remedies including termination rights for material security failures.

Essential information to capture in the supplement

Parties: Full legal names

Effective Date: MM/DD/YYYY

Data Types: PII, PHI, payment data

Controls: Encryption, MFA, logging

Breach Notice: Timeframe in hours/days

Audit Rights: SOC 2, penetration test

Step-by-step: completing a Security Supplement Agreement

Follow these sequential steps to populate, review, and finalize the supplement so it aligns with procurement and security expectations.

01

Gather documents: Collect main contract and scope exhibits before drafting.
02

Populate fields: Enter parties, effective date, covered data types, and controls.
03

Internal review: Have legal and security teams review for operational feasibility.
04

Sign and retain: Execute by authorized signatories and store copies securely.

How to set up the supplement for online completion

Configure an online workflow to collect signatures, evidence attachments, and conditional approvals while preserving an audit trail for compliance.

Field	Configuration
Signature blocks	Designate signers, sequence, and required initials where needed
Conditional approvals	Add logic for security team approval if high-risk data included
Evidence uploads	Allow attachments for SOC reports, certificates, and test results
Retention rules	Set automated storage and export options for audit copies

Where to send the completed Security Supplement Agreement

Routing depends on whether the supplement is internal, exchanged with a vendor, or submitted to a regulator; maintain copies in contract repositories.

Counterparty: Send executed copy to the vendor or client legal contact.
Contract repository: Upload the final agreement to centralized contract management systems.
Security team: Provide a copy to the security/compliance owner for monitoring.
Audit file: Store evidence and signed versions for audits and inspections.

Digital signing and eSubmission considerations

Use an e-signature platform that provides an audit trail, secure storage, and configurable authentication to satisfy legal and compliance requirements.

Authentication options: Email, SMS code, or stronger 2FA
Document formats: PDF and DOCX supported for signed export
Integrations: Connectors for CRM, cloud storage, and audit systems

Ensure the chosen platform supports HIPAA (BAA), retains cryptographically secure logs, and exports human-readable and machine-verifiable records for regulatory review.

Timelines and processing expectations

Security supplements often include fixed response windows and deadlines for remediation, reporting, and audit scheduling; define them clearly to avoid disputes.

Breach notification deadline:

24–72 hours after discovery

Remediation plan timeline:

30 days for initial corrective actions

Audit scheduling window:

30–60 days' notice for audits

Report delivery:

Deliver SOC reports annually or on request

Evidence retention:

Keep logs and reports per retention rules

Common mistakes when preparing a Security Supplement Agreement

Vague control language that omits measurable standards or versions, making compliance and verification difficult for both parties.
Failing to list subprocessors or permitting unlimited subcontracting, which obscures who actually handles regulated data.
Omitting breach notification timelines or testing requirements, delaying remediation and increasing regulatory risk.
Not aligning indemnity and insurance provisions to reflect actual breach and third-party liability exposure.

Penalties and legal risks of an incorrect or missing supplement

Contract breach: Material breach remedies apply

Regulatory fines: HIPAA penalties possible

Civil liability: Third-party claims and damages

Contract termination: Customer may terminate services

Reputational harm: Loss of trust and business

Insurance gaps: Coverage denial for noncompliance

Practical tips for accurate and efficient completion

These pragmatic recommendations reduce negotiation cycles and improve enforceability without adding unnecessary complexity.

Use measurable standards

Prefer specific controls and measurable performance criteria (for example encryption standards, patch timelines, and MFA requirements) rather than vague references to 'industry best practices'.

Require evidence not custom audits

Request current SOC 2 or ISO 27001 certificates and penetration test summaries instead of frequent bespoke audits to reduce cost and friction.

Define remediation timelines

Set clear time-bound remediation steps and escalation paths for vulnerabilities to avoid disputes about acceptable response and resolution.

Align insurance and liabilities

Ensure cyber insurance coverage aligns with indemnity provisions and that carriers accept the scope of contractual obligations.

Real-world examples of how organizations use security supplements

These brief case summaries show practical ways organizations incorporate security supplements into vendor relationships and contracts.

Optica Ventures LLC

Optica required vendor security attestations to onboard new providers.

The supplement specified SOC 2 and quarterly scans.
The practice reduced onboarding time and clarified remediation responsibilities while preserving business continuity and audit readiness.

Martin Properties

A property management firm added a supplement for tenant data handling.

It mandated encryption and access logging.
As a result, the firm standardized vendor obligations, improved incident response coordination, and reduced legal review cycles on new integrations.

Comparison: eSignature options for executing Security Supplement Agreements

Select an eSignature provider that meets your compliance and volume needs; the table below compares signNow with common alternatives on price and key capabilities.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

FAQs and troubleshooting for Security Supplement Agreements

Answers to common questions about validity, signing, evidence, and handling disputes related to security supplements.

Need help? Contact support

Is an e-signed supplement legally binding?
Yes. Under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are generally enforceable provided intent, consent, attribution, and record retention requirements are met.
Do I need a BAA for HIPAA-covered data?
Yes. If the supplement governs handling of Protected Health Information, require a Business Associate Agreement and ensure the vendor will sign a BAA and meet 45 CFR §164.530(j) retention and safeguard standards.
When is notarization required?
Most security supplements do not require notarization. If a signature notarization or witness is contractually required, follow the state-specific rules for notarization or RON in the relevant jurisdiction.
What evidence should I accept instead of full audits?
Accept recent SOC 2 Type II reports, ISO 27001 certificates, or third-party penetration test summaries combined with attestations to reduce cost and preserve assurance.
Can I revoke or amend a signed supplement?
A supplement can be amended only by mutual written agreement per the amendment clause. Revocation without consent may be a material breach and can trigger remedies in the underlying contract.
How long should I keep signed supplements?
Retain the executed supplement for the contract term plus at least three years; follow federal and industry retention rules such as IRC §6501(a) and 45 CFR §164.530(j) where applicable.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now