Username convention
Use a standardized format tied to an authoritative identity source (email or employee ID) to prevent duplicates and simplify audits.
A consistent User Account Identity and Password record improves access control, supports auditability for signed records, and reduces disputes about signer attribution under ESIGN and UETA. Accurate identity records also help organizations meet data-protection and industry compliance obligations, including HIPAA when protected health information is involved.
Different roles manage or supply account identity and password data depending on the workflow.
Clear role separation and documented responsibilities reduce shared-account risks and speed troubleshooting.
Use a standardized format tied to an authoritative identity source (email or employee ID) to prevent duplicates and simplify audits.
Define minimum length, complexity, and reuse rules. Consider passphrases and ban common or breached passwords for stronger protection.
Record MFA method (Authenticator app, SMS, hardware token) and activation date to strengthen signer attribution.
Set idle timeout and maximum session duration to limit exposure from unattended devices and stolen sessions.
Document approved reset methods, verification steps, and escalation paths to avoid social-engineering bypasses.
Log provisioning source, approver, effective date, and any identity proofing artifacts for compliance reviews.
| Field | Configuration |
|---|---|
| Password complexity | Minimum 12 chars, mixed classes |
| Session timeout | 15–60 minutes idle |
| MFA enforcement | Mandatory for privileged roles |
| Self-service reset | Email or SMS OTP workflow |
Ensure the platform supports needed integrations, authentication methods, and file formats before rolling out credential policies.
Verify vendor compliance properties, BAA availability for HIPAA, and API capabilities for automation and centralized provisioning.
Typical completion within 24–48 business hours
Enroll within 7 calendar days of activation
Commonly every 60–180 days depending on risk
Accounts may be disabled after 30–90 days
Investigate and notify per state law timelines
Initial provisioning request is logged and validated.
Verify identity using ID, email, or KBA as required.
Account activated and second factor bound to user.
Annual or role-change reviews to confirm access.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Verify | Verify | Verify | Verify |
| Bulk Send | Yes | Verify | Verify | Verify | Verify |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
Optica standardized user provisioning to one identity source for signers
Implemented MFA and stored identity proofing artifacts attached to signable forms
Responsible for provisioning, lifecycle management, SSO/SAML configuration, and enforcing password and MFA policies across the platform. Maintains logs and coordinates deprovisioning on role changes.
Supplies legal name, recovery contact, and selects a password and MFA method when prompted. Their consent and recorded actions establish signer attribution for ESIGN and related laws.