Match the agreement to the relationship

short · 30 min · Objective 5.3

Task

Work seven described relationships to the right agreement type, then write the security clauses each one needs. The acronyms are recall marks; the clauses are what makes the agreement a control.

Steps

  1. Write /tmp/relationships.md describing seven situations, one for each of SLA, MOU, MOA, MSA, SOW, NDA and BPA — without naming the instrument.
  2. For each, record the correct agreement and the single feature that decided it. For the MOU, that feature is that it is not intended to bind.
  3. Now add the security clauses. For each agreement, list the clauses it should carry: incident notification within a stated period, right to audit, approved sub-processors, data location, encryption requirements, return and destruction at termination, and liability.
  4. Mark which clauses must be negotiated BEFORE signature because there is no leverage afterwards.
  5. Write /tmp/agreements.csv as scenario,agreement,deciding_feature,key_clauses.
  6. For the SLA specifically, write the three ways a service level can be met on paper while the customer had a bad month.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/agreements.csv')))
assert len(rows)>=7, 'fewer than seven scenarios'
kinds={r['agreement'].strip().upper() for r in rows}
need={'SLA','MOU','MOA','MSA','SOW','NDA','BPA'}
missing=need-kinds
assert not missing, 'not covered: '+', '.join(sorted(missing))
mou=[r for r in rows if r['agreement'].strip().upper()=='MOU'][0]
assert 'bind' in mou['deciding_feature'].lower() or 'intent' in mou['deciding_feature'].lower(), \
    'the MOU was not distinguished by being non-binding'
for r in rows:
    assert r['key_clauses'].strip(), 'no clauses listed for '+r['agreement']
print('all seven instruments, each with a deciding feature and clauses')
PY
grep -ciE "excluded|planned maintenance|service credit" /tmp/agreements.csv /tmp/relationships.md

The MOU assertion checks the distinction the exam most often tests: it is the only instrument on the list whose defining property is that it does not bind. The final grep must be non-zero — you identified how an SLA can be met while the customer suffers, which is the difference between a measured service level and a promised one.

Notes

The 'before signature' marking is the practically important half. A right-to- audit clause is cheap to ask for during negotiation and impossible to obtain afterwards, and the same is true of incident notification timeframes — which matter because your own regulatory clock starts when the breach happens, not when the vendor decides to tell you.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.