Digital Signature Acceptance Policy
1.0 Purpose
As electronic communication and documentation become standard practice, digital signatures provide a mechanism for verifying the identity of a sender or signatory and ensuring message/document integrity. The purpose of this policy is to provide guidance ondefine when digital signatures are considered acceptedan meansacceptable ofand validatingtrusted thesubstitute identityfor oftraditional ahandwritten signer("wet") insignatures <Companyfor Name>internal electronicorganizational documents and correspondence, andthereby thus a substitute for traditional “wet” signatures, within the organization. Because communication has become primarily electronic, the goal is to reducereducing confusion aboutand whenstandardizing a digital signature is trusted.practice.
2.0 Scope
This policy applies to all <Company Name> employees and affiliates.
This policy applies to all <Company Name> employees, contractors, consultants, and other agents conducting <Company Name> business withon abehalf <Companyof Name>-providedthe organization using organization-issued digital identities (key pair.pairs). This policy appliesspecifically onlygoverns tothe use and acceptance of digital signatures on *intra-organization digitally signedorganizational* documents and correspondence (i.e., communications and documents shared solely within the organization). It does not tocover electronic materials sent to or received from non-<Companyexternal Name>parties affiliatedunless personsexplicitly stated otherwise in separate agreements or organizations.policies.
3.0 Policy Statements
3.1 Acceptance of Digital Signatures
* A digital signature applied using the organization's approved infrastructure and tools is considered an acceptable substitute for a wet signature on any intra-organizationorganizational document or correspondence, with**except** for specific document types explicitly excluded by the exceptionorganization.
* ofAn those noted on the site of the Chief Financial Officer (CFO) on the organization’s intranet: <CFO’s Office URL>
The CFO’s office will maintain an organization-wideofficial list of thedocument types ofrequiring documentstraditional andwet correspondencesignatures that are (not covered by this policy.policy) will be maintained by the designated financial or administrative authority (e.g., the Chief Financial Officer's office) and made available through designated internal resources (e.g., the organization's intranet).
3.2 Signature Validity
* Digital signatures must applybe toassociated individualswith only.an individual user's identity. Digital signatures forpurporting roles,to positions,represent a role, position, or titlestitle (e.g., the"Finance CFO)Department," "Project Manager") without being tied to a specific individual's key pair are not considered valid.valid under this policy for authentication purposes.
3.3 Responsibilities
Responsibilities
Digitaleffective signatureuse and acceptance requiresof digital signatures rely on specific actionactions onby both the part of the employee signing the document or correspondencesignatory (hereafter the signer), and the employeerelying receiving/reading the document or correspondenceparty (hereafter the recipient).
*
**Signer Responsibilities
* Signers must obtain aan official digital signing key pair fromissued <Companythrough Namethe identityorganization's managementdesignated Identity Management group>. or process.
* This key pair willmust be generated usingand <Companymanaged Name>’within the organization's approved Public Key Infrastructure (PKI), andwith the public key will be signedcertified by the <Companyorganization's Name>’sdesignated Certificate Authority (CA),.
<CA Name>.
Signers must signuse documentsonly organization-approved software and correspondencetools usingfor softwareapplying approveddigital bysignatures.
<Company Name>* IT organization.
Signers musthave a critical responsibility to protect their private key andfrom keepunauthorized itaccess, loss, or disclosure. The private key must remain secret.
* If a signer believessuspects that the signer’stheir private key washas stolenbeen orcompromised otherwise(e.g., compromised,stolen, lost, accessed by an unauthorized person), they must *immediately* report the signercompromise mustto contactthe <Company Name>designated Identity Management Group immediatelygroup to have the signer’s digitalinitiate key pairrevocation.
* revoked.
**Recipient Responsibilities
* Recipients must readuse organization-approved software and tools to view digitally signed documents andor correspondence usingand softwareverify approvedthe bysignatures.
<Company Name>* IT department.
Recipients must verify the validity of a digital signature. This includes checking that the signer’signature is cryptographically valid and that the signer's public key certificate was signedissued by the <Company Name>’organization's Certificatedesignated Authority (CA), <CA Name>,and has not expired or been revoked. Verification is typically performed automatically by viewingapproved thesoftware, but recipients should understand how to check certificate details aboutif theneeded.
signed key* using the software they are using to read the document or correspondence.
If the signer’sa digital signature doesappears notinvalid, appearexpired, valid,revoked, or associated with an untrusted CA, the recipient must not*not* trust the sourcesignature or the authenticity/integrity of the document based solely on that signature. Investigate further or correspondence.
resubmission.
* If a recipient believessuspects thatmisuse or forgery of a digital signaturesignature, has been abused, the recipientthey must report the recipient’s concern to <Companythe Name>designated Identity Management Group.group or Information Security team.
4.0 Compliance
4.1 Compliance Measurement
The designated IT authority (e.g., Precision Computer teamteam, Information Security, Internal Audit) will verify compliance towith this policy through various methods, including butaudits notof limitedthe to,PKI businessinfrastructure, toolreview reports,of internalapproved software lists, investigation of reported incidents, and externaluser audits,awareness and feedback to the policy owner. checks.
4.2 Exceptions
Any exception to thethis policy must(e.g., betemporary approveduse byof alternative methods under specific circumstances) requires formal, documented justification and advance approval from the designated IT authority (e.g., Precision Computer team inor advance.Information Security).
An4.3 employeeEnforcement
Failure to havecomply violatedwith this policypolicy, particularly regarding the protection of private keys or reporting compromises, may beresult subject toin disciplinary action, up to and including termination of employment.employment or contract. Misuse of digital signatures may lead to revocation of signing privileges and other sanctions.
5.0 Definitions
Note* that**Digital theseSignature:** referencesA werecryptographic mechanism used onlyto as guidance inverify the creation of this policy template. We highly recommend that you consult with your organization’s legal counsel, since there may be federal, state, or local regulations to which you must comply. Any other PKI-related policies your organization has may also be cited here.
American Bar Associationauthenticity (ABA)originator Digital Signature Guidelines http://www.abanet.org/scitech/ec/isc/dsgfree.html
Minnesota State Agency Digital Signature Implementationidentity) and Use
http://mn.gov/oet/policies-and-standards/business/policy-pages/standard_digital_signature.jsp
Minnesota Electronic Authentication Act https://www.revisor.leg.state.mn.us/statutes/?id=325K&view=chapter -stat.325K.001
City of Albuquerque E-Mail Encryption / Digital Signature Policy
http://mesa.cabq.gov/policy.nsf/WebApprovedX/4D4D4667D0A7953A87256E7B004F6720?OpenDocument
West Virginia Code §39A-3-2: Acceptancecontent) of electronic signaturedata.
* **Public Key Infrastructure (PKI):** A set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.
* **Certificate Authority (CA):** An entity trusted to issue, manage, and revoke digital certificates, which bind public keys to specific identities.
* **Key Pair:** In asymmetric cryptography, a pair of linked cryptographic keys: a public key (shared openly) and a private key (kept secret by governmentalthe entitiesowner).
* in**Private satisfactionKey:** The secret component of a key pair used to create digital signatures and decrypt messages encrypted with the corresponding public key.
* **Public Key:** The publicly shared component of a key pair used to verify digital signatures created with the corresponding private key and encrypt messages for the private key holder.
* **Wet Signature:** A traditional, handwritten signature requirement.on http:a physical document.
* Password Policy //law.justia.com/westvirginia/codes/39a/wvc39a-3-2.html Credential Management Policy
* Information Handling Policy
* Acceptable Use Policy
* (Potentially) Key Management Policy