Q-1-6 Electronic Signatures

I. Purpose

1. To provide guidance to units and employees of the University of Kentucky (UK) and its Affiliated Corporations on the implementation and use of an electronic signature process authorizing official transactions as permitted by Administrative Regulation 10:5 Electronic Signatures Policies and Procedures. This includes how to:
   1. determine what forms are appropriate for electronic signatures;
   2. gauge the level of security needed;
   3. determine which methodology or technology to use;
   4. obtain approval to use electronic signatures; and
   5. responsibly use electronic signatures. 

All users of University technology resources must adhere to the requirements of Administrative Regulation 10:7, Security of Data. 

II. Definitions

• Authentication: the process of securely verifying the identity of an individual prior to allowing access to an electronic UK service.
• Authorization: verification that an authenticated user has permission to access specific electronic services and/or perform certain operations.
• Electronic: relating to technology that has electrical, digital, magnetic, wireless, optical, or electromagnetic capabilities or similar capabilities.
• Electronic Signature (e-signature): an electronic sound, symbol or process that is attached to or logically associated with a record and that is executed or adopted with the intent to sign the record.
• Information: data, text, images, sounds, codes, computer programs, software, databases or similar items.
• Level of Security
  • Standard: Typically used for general administrative tasks, inter-departmental forms, and transactions that do not involve high-risk, restricted, or confidential data
  • Heightened: Typically required for transactions that mandate strict identity verification, signature non-repudiation, or strict compliance with federal regulations such as FERPA or HIPAA. 
• Transaction: an action or set of actions occurring between two (2) or more persons relating to the conduct of business, commercial, or governmental affairs.
• Unit: the unit conducting business by means of an e-signature; such as a college, department, auxiliary, or administrative division.

III. Responsibilities

1. UK ITS Enterprise Cybersecurity
   1. Provide assistance to units in the development or selection of the technology to be used for an electronic signature.
2. Unit Data Custodian (as defined in AR 10:3.II.D)
   1. Assist unit personnel with the development of the e-forms.
   2. Determine the level of security to be used for those forms, based on the recommendations in section IV. B below.
   3. Determine the technology to be used for e-signature methodology, also based on recommendations in section IV. C below.
   4. Review and give final approval to all e-forms used exclusively within a unit that do not require a heightened level of security.
      1. Review and approve inter-unit e-forms then forward to the Area Fiscal Officer (AFO) or designated approver.
   5. Initiate the required biennial review process.
3. AFO or designated approver
   1. Review and approve inter-unit e-forms.
   2. Submit e-forms to the Executive Vice President for Finance and Administration for final approval.
4. Employees
   1. Contact Unit Data Custodian for assistance with developing a new e-form, as needed.
   2. Provide information needed for Unit Data Custodian to make required determinations regarding security and appropriate technology, as described in section V.

IV. Policy

1. Electronic forms (e-forms) are considered to include:
   1. Any electronic process that requires authorization for its transaction to be initiated;
   2. Any electronic document that requires authorization for its intended transaction to be initiated; or
   3. Any electronic transaction that would otherwise require a handwritten signature for its intended action to be initiated. 
2. The e-signatures process must be secure:
   1. Acceptable level of security:
      Standard username and password protected authorization, as well as a second method of authorization such as, but not limited to:
      1. Single use password device
      2. Physical security token (e.g., thumb drive with embedded digital certificate)
      3. Two-party security token submission
3. Methodologies to be used:
   1. Preferred technologies to be used in either standard or heightened level of security are:
      1. ERP Automated Workflow
      2. Adobe Secure Sign
      3. UK Active Directory Authentication 
4. Other technologies that may be conditionally used in heightened level of security are:
   1. Public Key Infrastructure
   2. Proprietary technology
   3. Other (with approval given by Information Technology Services)
   4. Certain technologies will require proof of appropriate audit trail

V. Procedures

1. Electronic Signature Approval Process:
2. Any proposal for the implementation of an electronic signature must include:
   1. What the signature would be authorizing
   2. A rational for the level of security requested
   3. Detail of the methodology/technology used for the signature
   4. Potential risks and costs associated with implementation
3. For proposed electronic signatures intended for use in inter-unit forms, or for electronic signature requiring a heightened level of security:
   1. The Unit’s Data Custodian must submit the proposal for electronic signatures to the relevant AFO or designated approver for initial review.
   2. If the AFO or designated approver is then initially satisfied with the electronic signature security level, purpose, costs, and methodology, he or she will present it to the Executive Vice President for Finance and Administration (EVPFA) office for final approval.
4. For proposed electronic signatures intended for intra-unit forms, and do not require a heightened level of security:
   The Unit’s Data Custodian can give final approval for use if he or she is satisfied with the proposed signature’s security level, purpose, cost, and methodology.
5. Units must initiate a review and re-approval process on a biennial basis, following the original procedure laid out above.