SOW, MSA and MOU Explained: Agreement Types for the Security+ Exam

Agreement types are pure recall, and CompTIA leans on them because they matter operationally — the wrong document leaves you without recourse, and on a penetration test the wrong document leaves you without legal cover.

The statement of work

A SOW defines the specific work for a specific engagement: deliverables, scope, timeline, milestones, acceptance criteria and price. It is the document that answers "what exactly are you going to do, by when, and how will we know it is finished".

A SOW almost always sits beneath a master service agreement. The MSA is negotiated once and sets the standing legal terms — liability, confidentiality, payment terms, dispute resolution. Each project then adds a SOW covering only that project's specifics, with no renegotiation of the legal boilerplate.

That relationship is the exam point. MSA is the umbrella and persists; SOW is per-project and expires with the project.

The full set

Agreement	Purpose	Binding?
SOW — statement of work	Deliverables, scope and timeline for one engagement	Yes
MSA — master service agreement	Standing legal terms across many engagements	Yes
SLA — service level agreement	Measurable performance commitments and penalties	Yes
MOU — memorandum of understanding	Statement of shared intent	Usually not
MOA — memorandum of agreement	Roles and responsibilities; more formal than an MOU	Often
BPA — business partnership agreement	How partners share responsibility, profit and liability	Yes
NDA — non-disclosure agreement	Confidentiality obligations	Yes
ISA — interconnection security agreement	Security terms for a direct system-to-system connection	Yes
RoE — rules of engagement	Constraints on testing activity	Yes, within the engagement

The distinctions that get tested

MOU versus MOA. An MOU records intent and generally is not enforceable. An MOA sets out obligations and usually is. If a scenario describes two organisations agreeing to cooperate in principle with no obligations, that is an MOU.

SLA versus SOW. An SLA is about ongoing performance — uptime, response times, penalties. A SOW is about delivering a defined piece of work. A managed service has an SLA; a migration project has a SOW.

MSA versus SOW. Terms versus specifics, as above.

ISA. Specific to a direct technical connection between two organisations' systems, covering the security requirements each side must meet. If a question mentions a dedicated link or VPN between two companies and asks which agreement governs the security of that connection, it is the ISA.

Why this matters on PenTest+

For offensive testing the paperwork is the authorisation, and doing the work without it is a criminal act rather than a contractual dispute.

The SOW defines what will be tested and what deliverables are produced. The rules of engagement define how: testing windows, permitted techniques, prohibited actions such as denial of service or social engineering against named individuals, escalation contacts and stop conditions. An NDA protects what the tester finds. And an explicit authorisation to test, signed by someone with authority over the systems, is the document that makes the whole thing lawful.

Scope boundaries matter more than anything. Third-party and cloud-hosted systems often need separate authorisation from their owners, because your client cannot authorise testing of infrastructure they do not control.

What good scope looks like

Vague scope is where engagements go wrong. Specify IP ranges, domains and applications explicitly. State what is out of scope just as explicitly. Define the testing window and whether production is included. Name who may authorise a change mid-engagement. And agree in advance what happens if the tester finds an active compromise — stop and report, or continue.

What to remember

SOW is the specific work; MSA is the standing terms above it; SLA is measurable ongoing performance with penalties. MOU is intent and usually not binding; MOA carries obligations. ISA governs a direct system-to-system connection. For testing, the SOW plus rules of engagement plus signed authorisation are what make the work legal, and scope must be explicit about what is excluded as well as included.

Related reading: Due diligence and due care · SLO, SLA and SLI · STRIDE threat modeling