Agreement Types — Flashcards

SLA (Service Level Agreement): a formal legal contract that defines minimum acceptable performance standards for a service and includes financial penalties for failing to meet them. Required elements: (1) Uptime guarantee (99.9%, 99.99%, etc.; 99.9% = max 8.76 hours downtime/year). (2) Response time commitments (incident acknowledged within X minutes, resolved within Y hours). (3) Performance benchmarks (throughput, latency, availability). (4) Financial penalties (service credits, refunds, liquidated damages for missing SLAs). (5) Security obligations (encryption standards, patch timelines, breach notification). Key characteristic: SLAs are binding contracts with measurable thresholds and financial consequences. The financial penalty component is the defining SLA feature that distinguishes it from a general service description. Security SLA negotiation: when SLAs do not include security-specific commitments (breach notification timelines, minimum security controls, audit rights), the SLA is incomplete from a security perspective. BIA relationship: SLA terms with cloud providers must align with the RTO and RPO established in the BIA.

MOU (Memorandum of Understanding): a document that establishes mutual understanding and shared intent between two parties without creating legally binding contractual obligations. Characteristics: informal compared to a contract; describes high-level goals and intent; may include general confidentiality expectations but not formal NDA requirements; does not specify financial penalties for non-compliance; not typically filed as a legal contract. When used: early stages of a partnership before full contractual terms are negotiated; government-to-government agreements (very common in public sector); interagency cooperation; information-sharing relationships; situations where both parties want to document shared intent without incurring full legal obligations. Limitations: because it is generally not binding, a party who violates the MOU may face only reputational consequences, not legal liability. Not a substitute for a formal NDA or contract when legal protection is needed. Progression: MOU often precedes a formal contract. Parties agree on intent via MOU, then negotiate the full contractual details. MOU → MOA → MSA represents increasing formality.

MOA (Memorandum of Agreement): one step more formal than an MOU. Documents specific commitments and responsibilities rather than just broad intent. Conditionally binding — parties commit to the specific terms documented — but less formal than a full legal contract. Characteristics: more specific than an MOU (includes defined responsibilities, timelines, and deliverables); conditionally binding (the specific commitments must be honored); does not carry full legal enforceability with defined remedies. When used: inter-departmental agreements within the same organization; government agency cooperation where specific deliverables are committed; partnerships where full contract negotiation is not warranted but more commitment than an MOU is needed. Comparison: MOU = intent and broad goals (not binding). MOA = specific commitments (conditionally binding, no full legal remedies). MSA = full legal obligations with remedies. Exam tip: the MOU/MOA distinction turns on specificity and conditional binding. MOU: "We will cooperate on threat intelligence." MOA: "Agency A will deliver threat reports by the 15th of each month; Agency B will share malware samples within 48 hours of discovery."

MSA (Master Service Agreement): a fully legally binding contract that establishes the framework governing all future transactions between two parties in a long-term relationship. Covers terms and conditions that apply to every engagement. What MSAs include: payment terms, liability limitations and indemnification, intellectual property ownership, confidentiality obligations, dispute resolution (arbitration or litigation), termination conditions, governing law, and security obligations. How MSAs work with Work Orders: the MSA is signed once and governs the entire relationship. Individual projects are initiated via Work Orders (WOs) or Statements of Work (SOWs) that reference the MSA. The WO specifies the project-specific details (scope, deliverables, schedule, pricing) without re-negotiating fundamental contract terms. Security provisions in MSAs: minimum security standards, right-to-audit clause, breach notification requirements, data handling restrictions, personnel background check requirements. Why MSAs matter: eliminate renegotiation of fundamental terms for each new project; reduce contract cycle time; ensure consistent legal protections across all engagements. Never start significant work without an executed MSA in place.

Work Order (WO) / Statement of Work (SOW): a specific document issued under an existing MSA that defines a particular engagement, project, or piece of work. Translates the general MSA framework into a concrete, scoped project. Required elements: (1) Scope: exactly what will be delivered; what systems, processes, or locations are included. (2) Schedule: start date, end date, milestones. (3) Deliverables: specific outputs (report, code, configuration) and format. (4) Acceptance criteria: how "done" is defined; what standards the deliverable must meet for payment. (5) Pricing: cost for this specific engagement. (6) Personnel: who will perform the work (when specific expertise is required). Security context: a penetration test SOW specifies IP ranges in scope, authorized techniques, schedule, deliverable format, and acceptance criteria. A managed services SOW specifies which systems are monitored, SLA terms, and what the provider will and will not do. Exam trap: don't confuse SOW with rules of engagement. SOW is the contract. Rules of engagement are the operational parameters. For a pen test, you need both.

NDA (Non-Disclosure Agreement): a formal legal contract binding parties to keep specified information confidential. Always requires authorized signatures. Always specifies what information is covered (definition of confidential information), duration of obligation, and exclusions (publicly available information is typically excluded). Unilateral NDA: one-directional. One party discloses; only the receiving party is bound by confidentiality. Used when: an employer onboards an employee (employer shares proprietary info), a company shares designs with a vendor (company discloses, vendor protects). Bilateral (Mutual) NDA: both parties share confidential information; both are bound by confidentiality. Used when: partnership negotiations where both sides share proprietary information, joint security research where both organizations share vulnerabilities. Multilateral NDA: three or more parties; all share confidential information and all are bound. Used when: multi-party joint ventures, consortia, or intelligence-sharing groups with three or more members. Security use cases: always require NDA before sharing penetration test reports, vulnerability details, network topology, or security architecture with any external party.

BPA (Business Partners Agreement): a contract governing the terms of a partnership relationship where two or more organizations work together as partners (rather than as customer and vendor). What BPAs cover: (1) Ownership stake: percentage of ownership, equity, revenue, profit, and loss allocation for each partner. (2) Decision-making authority: who decides what types of decisions; joint decisions vs. individual partner authority; voting rights; dispute resolution for partnership disagreements. (3) Contingency planning: what happens if a partner encounters financial difficulties, becomes insolvent, or cannot fulfill obligations (buyout rights, dissolution procedures). Also covers continuity during natural disasters, regulatory changes, or operational disruptions affecting one partner. (4) Exit provisions: conditions for exiting the partnership, buyout terms, dissolution procedures. Security provisions: data handling responsibilities, security standards each partner must maintain, incident notification obligations between partners, audit rights. Exam distinction: BPA = partnership governance (joint venture, co-investors). MSA = customer-vendor relationship framework. Both are legal contracts but govern fundamentally different relationship types.

Classification approach: Ask these questions in order. Q1: Is there a service being provided with measurable performance standards? Yes + financial penalties = SLA. Q2: Is it a partnership (both parties have equity stake or revenue share)? Yes = BPA. Q3: Is confidential information being shared? Yes + formal signatures needed = NDA (unilateral/bilateral/multilateral based on who shares). Q4: Is there a long-term vendor relationship with multiple future projects? Yes, legal framework = MSA. Specific project under that framework = WO/SOW. Q5: Is there an intent to cooperate without full legal obligations? Broad intent only = MOU. Specific commitments (conditionally binding) = MOA. Key distinguishers: Financial penalties = SLA. Ownership/equity = BPA. Confidentiality + signatures = NDA. "Framework for all future work" = MSA. "Specific project under existing agreement" = WO/SOW. "Broad shared intent, not binding" = MOU. "Specific commitments, conditionally binding" = MOA. Exam trap: an agreement can include elements of multiple types (an MSA may contain SLA-like performance standards). Identify the PRIMARY purpose of the agreement.

From least to most formal and binding: MOU (least): mutual intent; generally not legally binding; no financial penalties; broad goals; common in government/interagency. MOA: specific commitments; conditionally binding; more formal than MOU but lacks full legal remedies. NDA: formal legal contract for confidentiality specifically; binding with legal remedies; requires signatures; narrowly scoped to information protection. SLA: formal contract focused on service performance; binding with financial remedies (service credits, refunds) for non-performance; measurable thresholds. MSA (most comprehensive): full legal contract governing entire relationship; all terms legally enforceable; provides the framework for all future work. WO/SOW: legally binding for the specific engagement; derives force from the parent MSA. BPA: full legal contract governing partnership; equity, decision-making, and contingency provisions all legally enforceable. Practical sequence: MOU (intent) → MSA (framework) → WO/SOW (specific work). NDA is signed early in any relationship where confidential information will be shared. SLA is embedded in MSA or WO as applicable.

Security provisions belong in multiple agreement types but must be deliberately negotiated: In MSAs (framework for entire relationship): minimum security standards the vendor must maintain (encryption, access controls, patch management), right-to-audit clause (contractual right to verify vendor security), breach notification timeline (vendor must notify within X hours of discovering a breach affecting customer data), data handling restrictions (what the vendor may and may not do with customer data), personnel background check requirements for staff who will handle sensitive data. In SLAs: security-specific performance metrics (security patch application timeline, vulnerability remediation SLA, incident response time), uptime guarantees for security services (SIEM, monitoring). In NDAs: definition of confidential information (include security architecture, vulnerability data, pen test reports, network topology), duration of confidentiality obligation (often longer than the business relationship), obligations upon termination (return or destruction of confidential materials). In BPAs: security standards each partner must maintain, incident notification obligations between partners, audit rights over partner's security controls. Warning: agreements without explicit security provisions leave security obligations undefined and unenforceable.