Security best practices for eSignature in remote use cases

In this era of remote work and digital transformation, businesses are rapidly adopting new ways of conducting transactions. One tool that has gained prominence is the use of eSignatures. With the ability to authenticate signers and documents in a paperless and secure manner, eSignatures have become a vital component in the growth of remote digital business transactions.

Remote eSignature use cases

Around the world, people now rely more than ever on remote interactions, often directly through their phone. While you have likely digitized some of your core business processes, many may not yet be fully automated.

The good news is that eSignatures keep business and government services fully digital. Here are examples of remote eSignature use cases:

• Lending: eSignature is helping banks, lenders, and borrowers close loans and financing faster. The technology is integrated into lending portals and enables banks to authenticate each signatory and capture legally binding signatures remotely.
• Deliver government services from anywhere: Federal, state, provincial, and local governments are using eSignature to issue permits, obtain authorizations, and execute agreements to deliver critical government services in the field.
• Remote account opening: New customer acquisition remains a priority for retail banks and insurers. Financial institutions of all sizes are integrating eSignature and digital identity verification technologies into their core systems to enable a faster and easier process, online and on mobile devices.
• Healthcare: Hospitals, clinics, and other healthcare providers are automating paper-intensive, patient-intake processes. The use of electronic signature software enables patients to eSign intake forms and consent documents remotely, in advance of their visit to provide a faster and contactless intake process.
• Hiring and onboarding: In certain industries, there is intense competition for the best candidates. By streamlining the hiring process and enabling candidates to eSign from anywhere directly on their mobile device, businesses demonstrate their ability to innovate, meet employee expectations, and move at the speed of digital.
• Remote sales: The use of digital signing software enables remote selling. NDAs and sales contracts can be completed digitally – from anywhere and on any device. What’s more, eSignature integrations with Salesforce empower sales teams to automate contracting workflows directly from their CRM.

Critical eSignature risks explained

eSignature technology is known for its ease of use. Businesses and government organizations see an immediate ROI because of the net-positive impact on the customer experience. However, Gartner explains that it is important that business stakeholders look beyond front-office customer experience requirements and engage with cross-functional teams (e.g., legal, IT, security, and risk) to establish risk-based policies for remote use cases before selecting an e-signature partner.

Here are three areas to consider before implementing a solution for remote document signing:

Enterprise-wide requirements

As the market continues to mature and businesses move beyond their initial set of use cases, you need to prepare an eSignature enterprise strategy to support the inevitable eSignature requests that will come from every department in your organization. Otherwise, you risk ending up with overlapping, inconsistent, and redundant solutions across the enterprise. An enterprise strategy eliminates this.

Thinking proactively about this involves understanding the use cases and requirements from all corners of the business and evaluating vendors’ ability to meet those requirements.

Over years of enterprise-wide deployments, we have learned the best practices to achieve enterprise digitization. OneSpan has deep experience with how to develop an eSignature center of excellence for delivering integrated applications with central governance. We help our customers understand how to build once and scale across all business lines and departments.

Legal & compliance requirements

The selection of a remote signing service should rest on the vendor’s ability to address requirements such as:

• Support for multiple signature methods
• Verifying the identity of unknown individuals through real-time digital identity verification
• Authenticating customers with established identities
• Detailed audit trails to provide a verifiable record of compliance
• Ability to fully white-label the user experience  
• Compliance with applicable eSignature regulations around the world, including support for qualified electronic signatures based on digital certificates issued by a Trust Service Provider (where required)
• Ability to meet eSignature security requirements for remote use cases

The EU’s eIDAS regulation provides one of the more comprehensive eSignature frameworks in the world to ensure a high degree of identity assurance during the signature process. Choosing the right eSignature partner can take care of most of the compliance burden and reduce legal risks.

The OneSpan Sign eSignature platform is designed to meet these requirements, making it easy for organizations to capture legally binding signatures that are valid in countries with electronic signature laws. We also help our customers meet their Know Your Customer (KYC) compliance needs with digital identity verification and authentication capabilities that establish trust with each individual for remote, faceless transactions.

In the U.S., electronic signatures are regulated at the federal level by the Electronic Signatures in Global and National Commerce Act (ESIGN Act) and at the state level by the Uniform Electronic Transactions Act (UETA).

Cybersecurity requirements

Security measures are increasingly important to eSignature evaluation and selection. With consumers engaging in higher-risk transactions in remote channels, it’s important to ensure your technology solutions have adequate levels of underlying security and assurance about each signer’s identity for each signed document.

Our solution is trusted by some of the world’s most security-conscious organizations and designed according to security best practices. We comply with a variety of regulatory, industry, and IT standards for security and data protection, including certifications like SOC 2 Type II, ISO/IEC 27001, ISO 27017, and ISO 27018. OneSpan also has several FedRAMP ATOs (Authority to Operate).

OneSpan goes beyond electronic signatures and enables businesses to establish trust in people’s identities, the devices they use, and the transactions they carry out – to help protect the digital customer experience. According to Cybersecurity Insiders:

Security is a cornerstone of OneSpan Sign’s offering. The platform ensures the integrity of the documents being signed as well as the transactional workflow. Each document is protected by digital signature encryption and a tamper-evident seal, providing robust digital evidence to confirm that a document has not been altered during the signing process. […] The platform undergoes regular updates to counteract vulnerabilities and supports a wide array of platforms, operating systems, and browsers without compromising on security standards.

eSignature due diligence checklist

The requirements mentioned above are driven by region-specific laws and industry regulations tied to privacy, data residency, and the legality of different types of eSignatures. Make sure to do your due diligence and fully understand the IT, legal, compliance, and security implications before selecting your next eSignature partner. Here’s a handy checklist of things to look for during the evaluation process:

• Does the vendor have experience with enterprise-wide and shared service deployments?  
• Does the solution address requirements for multiple geographies, use cases, and channels?  
• Does the solution support remote identity proofing and authentication, to verify the signer of an electronic document?  
• Is the solution managed according to cloud security and data protection best practices?  
• Does the solution offer multiple data centers and deployment types to help businesses meet data residency and privacy requirements, and restrict where data can be stored and processed?  
• Does the solution leverage digital signature technology?
• Does the solution offer secure storage for business agreements that need to be protected for the long-term?

Balancing risk and demand with remote electronic signatures

The demand for remote signatures continues to intensify as businesses increasingly engage with employees, partners, and customers remotely. However, eSignature solutions are not without risk. Businesses need to gain buy-in from multiple stakeholders before selecting and implementing a solution. Time-to-market pressures are real, but without doing proper due diligence your organization faces risks and costs in the long-term.

Customer experience will continue to be the leading business driver for eSignature. Still, as businesses increasingly transact remotely, they will need to protect the digital customer experience at all costs – without diminishing the experience and, ultimately, adoption.

To learn more about OneSpan's eSignature solutions and how they can benefit your organization, reach out to our team of experts.

Contact us today to book a consultation and discover how OneSpan can empower your remote signing use cases while reducing risk, strengthening cybersecurity, and enhancing the customer experience.