Can this agreement be signed electronically?

Yes. Electronic signatures meet legal requirements under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention requirements are satisfied.

When is notarization required?

Notarization is rarely required for vendor assurances, but state rules may require notarization or witnesses for related instruments; check the applicable state notary rules before execution.

Who must sign on behalf of the vendor?

An authorized officer or representative with delegated signing authority must sign; verify through corporate resolution or a power of attorney to avoid challenges to enforceability.

What evidence should vendors provide?

Acceptable evidence includes SOC reports, ISO 27001 certificates, penetration test summaries, and signed attestations; specify formats and recency in the agreement.

How long should we keep signed agreements?

Retain executed agreements for the contract term plus at least three years; follow federal and industry retention rules (e.g., IRC §6501(a), 45 CFR §164.530(j)).

Can the agreement be amended digitally?

Yes. Amendments executed electronically must meet the same ESIGN/UETA criteria and should reference the original agreement and amendment effective date.

Electronic Signature
Templates
Miscellaneous
Third Party Assurance Agreement

Third Party Assurance Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

THIRD PARTY ASSURANCE AGREEMENT

This Third Party Assurance Agreement (the Agreement) is entered into as of by and between Assuring Party: , and Recipient: . The Assuring Party and Recipient are each a Party and together the Parties.

RECITALS

WHEREAS, Assuring Party has expertise, personnel, methodologies and systems to perform independent assurance services related to compliance, controls, performance or other specified criteria as requested by the Recipient; and

WHEREAS, Recipient requires independent assurance regarding the performance, systems, practices or representations of a Third Party identified as the Assured Entity: ; and

WHEREAS, Assuring Party is willing to provide such assurance in accordance with the terms and conditions set forth in this Agreement.

SCOPE OF WORK

Assuring Party shall perform assurance services as described below, which shall include testing procedures, criteria, reporting obligations and any agreed deliverables. The scope shall be limited to the matters expressly described and to the time periods set forth herein.

Detailed Scope and Deliverables Reporting Schedule

PAYMENT TERMS

Recipient shall pay Assuring Party for the services performed in accordance with the following payment terms. All amounts are exclusive of applicable taxes unless otherwise stated.

Total Fee Payment Schedule / Milestones Invoice Due Days Late Payment Fee

TERM AND TERMINATION

This Agreement commences on Start Date and continues until End Date unless earlier terminated in accordance with this section. Start Date: ; End Date: .

Notice Period for Termination Without Cause (days) Termination for Cause

CONFIDENTIALITY

Each Party shall maintain in confidence all Confidential Information obtained from the other Party and shall not disclose such information to any third party except as permitted in this Agreement. Confidential Information excludes information that: (a) is or becomes publicly known through no breach of this Agreement; (b) is rightfully received from a third party without restriction; (c) is independently developed without use of the other Party's Confidential Information; or (d) is required to be disclosed by law, regulation, or judicial process, provided the disclosing Party gives prompt notice to the other Party and limits the disclosure to the extent legally required. Obligations of confidentiality shall survive termination for a period of .

REPRESENTATIONS AND WARRANTIES

Each Party represents that it has the full power and authority to enter into this Agreement and to perform its obligations. Assuring Party represents that the assurance services will be performed in a professional manner consistent with applicable standards and industry practice; provided, however, that Assuring Party does not warrant future results or guarantee regulatory outcomes.

LIMITATION OF LIABILITY; INDEMNIFICATION

Except for liability arising from willful misconduct or gross negligence, neither Party shall be liable to the other for indirect, incidental, special or consequential damages, even if advised of the possibility of such damages. The Parties' aggregate liability for direct damages arising out of this Agreement shall not exceed the fees paid by Recipient to Assuring Party under this Agreement during the twelve (12) months preceding the event giving rise to the claim. Recipient shall indemnify, defend and hold harmless Assuring Party from claims arising from Recipient's misuse of reports, reliance beyond intended scope, or material misstatements by the Assured Entity.

NOTICES

All notices under this Agreement shall be in writing and delivered to the addresses below by hand, certified mail, or a nationally recognized overnight courier, and shall be deemed given upon receipt.

Assuring Party - Notice Contact and Address Recipient - Notice Contact and Address

GOVERNING LAW; DISPUTE RESOLUTION

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction of , without regard to its conflicts of law principles. The Parties shall first seek to resolve disputes in good faith through negotiation. If unresolved, the Parties agree to submit disputes to binding arbitration in the same jurisdiction unless otherwise mutually agreed in writing.

ENTIRE AGREEMENT; AMENDMENT

This Agreement, including any schedules or exhibits expressly incorporated, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior oral or written agreements. Any modification or amendment must be in writing and signed by authorized representatives of both Parties.

MISCELLANEOUS

Assignment: Neither Party may assign its rights or obligations under this Agreement without the prior written consent of the other Party, except to an affiliate or in connection with a merger or sale of substantially all assets. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Assuring Party - Printed Name:

By:

Date:

Recipient - Printed Name:

By:

Date:

What the Third Party Assurance Agreement Is and When it Applies

A Third Party Assurance Agreement is a formal written representation that a vendor, subcontractor, or external service provider meets specified security, compliance, or operational requirements for work performed on behalf of a contracting party. Typical entries describe scope, controls, reporting obligations, audit rights, and timeframes for corrective action. The document documents the provider's commitments, assigns responsibility for specific controls or deliverables, and creates a contractual basis for periodic verification and remediation. Organizations use it to reduce supply‑chain risk and to demonstrate due diligence during audits or regulatory review.

Why a Third Party Assurance Agreement Matters to Risk and Compliance

The agreement documents third‑party commitments to safeguards and provides a contractually enforceable basis for monitoring, audits, and corrective action. It reduces regulatory exposure, supports vendor risk management, and creates evidence for internal and external auditors.

Who Typically Prepares and Signs These Agreements

Organizations that manage vendor relationships, procurement teams, compliance officers, and external providers are the primary users of Third Party Assurance Agreements.

Vendor Risk and Procurement Teams — Draft terms, define controls, and manage acceptance criteria during vendor onboarding.
Compliance and Legal Departments — Negotiate liability, audit rights, data handling, and regulatory clauses to reduce exposure.
Service Providers and Subcontractors — Complete attestations, list certifications, and provide evidence of controls and third‑party audit reports.

Properly completed agreements create clear expectations between parties and enable consistent, auditable vendor oversight throughout the engagement lifecycle.

Core Components to Include in a Professional Agreement

A robust Third Party Assurance Agreement contains definitions, scope of services, security controls, monitoring and reporting obligations, audit and remediation rights, and signature blocks for authorized representatives.

Scope

Define covered services, systems, geographic limits, and exclusions to avoid ambiguity about responsibilities.

Security Controls

Specify required security frameworks (e.g., SOC 2, ISO 27001), minimum control objectives, and baseline technical measures.

Data Handling

Clarify data categories, permitted uses, encryption requirements, and requirements for transborder transfers.

Audit Rights

State frequency, format, and notice requirements for audits, plus alternatives such as shared audit reports.

Remediation

Describe timelines for corrective actions, escalation paths, and acceptable proof of remediation.

Liability & Indemnity

Allocate responsibility for breaches, define caps or carveouts, and reference applicable governing law.

Step-by-Step: How to Complete the Agreement

Follow these sequential steps to prepare, review, and finalize a Third Party Assurance Agreement efficiently.

01

Prepare Draft: Populate party names, scope, and control requirements.
02

Internal Review: Legal and compliance review for liability and regulatory clauses.
03

Provider Response: Vendor confirms controls, provides evidence, and proposes edits.
04

Finalize Signatures: Obtain authorized signatures and retain executed copies.

Notification and Routing: Typical Flow from Draft to Execution

A clear routing process reduces delays; outline who receives each version and how approvals are recorded.

Create Document: Draft agreement from a template including required fields.
Assign Reviewers: Send to legal, security, and procurement for input.
Send to Vendor: Provide a single consolidated version with change log.
Collect Signatures: Obtain signatures and distribute executed copies to stakeholders.

Suggested Digital Workflow Settings for eSigning and Verification

Configure your digital workflow to capture identity, time stamps, and evidence that supports legal enforceability under ESIGN and UETA.

Field	Configuration
Signer Authentication	Email link plus SMS code for moderate assurance
Evidence Capture	Retain audit trail with IP, timestamp, and email record
Conditional Fields	Show fields only after vendor accepts specific clauses
Document Storage	Store final PDF/A with embedded audit certificate

Technical Requirements for Electronic Execution and Evidence

Use a platform that captures authenticated signer identity, timestamped audit trails, and a tamper-evident final document.

Authentication: Support email, SMS code, or higher‑assurance KBA/2FA.
Audit Trail: Record IP, timestamp, and signer events.
Document Formats: Accept PDF, DOCX and produce signed PDF/A outputs.

Retain the signed document and associated evidence to meet ESIGN record retention requirements and to support audits or regulatory inquiries.

Common Preparation Pitfalls to Avoid

Leaving scope vague or open‑ended, which leads to disputes over what services or systems are covered and who is responsible for fixes.
Failing to specify acceptable evidence, resulting in vendors delivering inadequate reports or auditors rejecting documentation as incomplete.
Not defining remediation timelines or escalation paths, which delays vulnerability remediation and increases regulatory risk.
Using non‑authorized signers or unsigned amendments, which can render commitments unenforceable or delay contract activation.

Key Risks When the Agreement Is Incorrect or Incomplete

Regulatory Exposure: Fines or corrective actions

Contractual Liability: Indemnity or damages claims

Operational Disruption: Service outages or remediation costs

Audit Findings: Failed audits and remediation orders

Data Breach Impact: Notification and breach costs

Reputational Harm: Loss of customer trust

Typical Timelines for Review, Execution, and Ongoing Verification

Set clear deadlines for each stage to keep vendor oversight current and enforceable; document timelines in the agreement to avoid ambiguity.

Initial Response:

Vendor returns completed assurance within 10–30 days of request.

Audit Frequency:

Annual or as‑needed audits, commonly every 12 months.

Remediation Window:

Vendors often have 30–90 days to remediate control gaps.

Evidence Submission:

Provide attestation reports within 30 days of request.

Rekey / Reassessment:

Reassess after material changes or annually, whichever occurs first.

Key Milestones from Request to Ongoing Monitoring

Track milestones with ownership and target dates to maintain an auditable vendor oversight program.

01

Request Issued

Procurement issues the assurance request and deadline to the vendor.

02

Vendor Response

Vendor returns completed attestation and supporting evidence.

03

Review & Approval

Internal teams review evidence and approve or request remediation.

04

Ongoing Monitoring

Schedule periodic re‑reviews and update records after material changes.

eSignature Pricing and Core Capability Snapshot for Agreement Execution

Comparison of starting prices and core features relevant to executing Third Party Assurance Agreements; signNow is listed first per platform ordering rules.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7‑day free trial, no credit card	Varies	Varies	Varies	Varies
Bulk Send	Yes (Business Premium)	Varies	Varies	Varies	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Yes	Yes	No	No

Frequently Asked Questions About Third Party Assurance Agreements

Answers to common questions when preparing, executing, and storing Third Party Assurance Agreements to reduce delays and compliance gaps.

Need help? Contact support

Can this agreement be signed electronically?
Yes. Electronic signatures meet legal requirements under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention requirements are satisfied.
When is notarization required?
Notarization is rarely required for vendor assurances, but state rules may require notarization or witnesses for related instruments; check the applicable state notary rules before execution.
Who must sign on behalf of the vendor?
An authorized officer or representative with delegated signing authority must sign; verify through corporate resolution or a power of attorney to avoid challenges to enforceability.
What evidence should vendors provide?
Acceptable evidence includes SOC reports, ISO 27001 certificates, penetration test summaries, and signed attestations; specify formats and recency in the agreement.
How long should we keep signed agreements?
Retain executed agreements for the contract term plus at least three years; follow federal and industry retention rules (e.g., IRC §6501(a), 45 CFR §164.530(j)).
Can the agreement be amended digitally?
Yes. Amendments executed electronically must meet the same ESIGN/UETA criteria and should reference the original agreement and amendment effective date.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now