CompTIA PenTest+ (PT0-003)Engagement ManagementMedium
A security firm has a five-year Master Service Agreement (MSA) with a large enterprise client that establishes payment terms, liability caps, and confidentiality obligations for all future engagements. The client now wants a new penetration test performed on a recently acquired subsidiary's network. Which document should be created next before testing begins?
- AA Statement of Work (SOW) defining scope, deliverables, and timeline for this specific test
- BA new NDA to replace the MSA
- COnly verbal confirmation from the client's IT director
- DA second MSA specific to the subsidiary
Show answer & explanationAnswer & explanation
Correct answer: A. A Statement of Work (SOW) defining scope, deliverables, and timeline for this specific test
The MSA governs the overall relationship, but each individual engagement requires an SOW that defines the specific scope, deliverables, cost, and timeline for that particular project.
Why the other options are wrong
- B. The NDA already exists under/alongside the MSA; it doesn't define engagement specifics.
- C. Verbal agreements are insufficient and provide no legal protection or clarity.
- D. A new MSA is unnecessary since the existing one already governs the relationship.
Statement of Work (SOW)
A contract document defining the specific scope, deliverables, timeline, and cost of an individual engagement, typically under an existing MSA.
- Created for each specific project/engagement
- References the overarching MSA terms
- Includes scope, deliverables, and schedule
Memory trick: MSA is the umbrella; SOW is each raindrop underneath