Electronic Signatures Policy

Electronic Signatures Policy Objective

This Policy will provide guidance to the campus on the appropriate use of electronic signatures. This guidance applies to all faculty and staff at San Francisco State University.

Statement

San Francisco State University has elected to use electronic signatures for campus-approved University business processes. 

Process

I. Appropriate Use of Electronic Signatures

San Francisco State University has elected to use electronic signatures for campus-approved University business processes. Per CSU ISO Policy, Domain 10, the campus has developed an Electronic Signature Risk Assessment procedure to identify, evaluate, and document where electronic signatures are permitted. Electronic signatures must only be used on documents that have been approved through the Electronic Signature Risk Assessment, with the exception that memoranda and departmental forms routed internally (i.e., forms owned by a department and only sent to individuals within the department) are not required to undergo a risk assessment.

Adobe Sign is the approved campuswide electronic signature solution. All faculty and staff will have access to a Adobe Sign account. The account shall only be utilized for University business purposes and must not be used for personal transactions.  Future hires may use Adobe Sign to complete University transactions. 

• Level 1 Data

  • Electronic signatures may be used on forms containing certain Level 1 (Confidential) data. Adobe Sign is approved for use with Level 1 data and Personally Identifiable Information. Adobe Sign is not approved for use with PCI data (credit card information) or HIPAA data (medical records). Please refer to Sensitive Data Policy for more information about confidential data.

• External Parties

  • Electronic signatures may be used for documents that are external (involve parties other than San Francisco State University faculty and staff) or that are considered to be high risk (see section III of this Policy). Adobe Sign s the approved tool for all University related business processes that involve SF State employees and external parties (signers must operate within their delegation of signing authority). For processes that involve external parties, please refer to this Security Matrix and apply the recommended security control based on the risk level of your documents. If department would like additional guidance, please contact qateam@sfsu.edu. 

• Student Access

  • Electronic signatures are appropriate for select student forms as well. Approved forms may be routed to students for signature.

• Contracts and Legal Documents 

  • Electronic signatures may be used for unilateral contracts, as well as for bilateral contractual and legal documents.

II. Business Process Ownership

Business processes and associated documents are managed by campus process owners. The department that owns a particular business process is the only entity that may modify or upload the document for use in Adobe Sign. Department business process owners are responsible for initiating an Electronic Signature Risk Assessment (see section III of this Policy) for the use of electronic signatures.

III. Electronic Signature Risk Assessments

The business process owner initiates and is directly involved with the Electronic Signature Risk Assessment process. During the Electronic Signature Risk Assessment, the following topics will be considered:

1. The purpose and intent of the document;
2. The parties involved;
3. The routing of the document, and
4. The contents of the document and any other associated attachments.

The Electronic Signature Risk Assessment will determine whether the process and associated documents in question are considered to be low, moderate, or high risk. Six risk impact categories, along with the likelihood of occurrence and potential mitigating factors, are used to assess each form:

CSU Electronic and Digital Signatures Standards and Procedures, ISO Domain 6 - Maximum Potential Impacts for Each Assurance Level.

The campus has determined that, because faculty and staff will authenticate their identity through single sign-on, there is a “Level 3: high confidence in the asserted identity’s validity.” See ISO Policies, Domain 6.

If, based on the Electronic Signatures Risk Assessment, the form is approved, the campus may then begin utilizing electronic signatures on that particular document.

IV. Record Storage and Maintenance

Departments shall continue to maintain their records in accordance with the appropriate record retention policy and ITS-recommended file storage solutions. Adobe Sign shall not be used as a file storage solution.

Upon the completion of the transaction, the responsible department(s) should download both the completed document and any supporting documents for storage in accordance with best practices and in a way that is easily auditable. It is also recommended that the department download the accompanying certificate of completion, which will act as a supporting document and provide a digital audit trail.

V. Account Access and Management

San Francisco State University staff and faculty will be able to utilize electronic signatures through Adobe Sign by logging in with their SFSU ID and password. As a best practice, users should set up their signature the first time they log in and should not alter their defined signature once it has been created.

For consistency, users should utilize the same name used for University business purposes.

Non-Compliance

Noncompliance with applicable policies and/or practices may result in the removal of Adobe Sign account access. In addition, disciplinary action may be applicable under other University policies, guidelines, implementing procedures, or collective bargaining agreements.

Procedures

Please visit the Adobe Sign at SFSU for more information and help guides.