CompTIA PenTest+ (PT0-003)Engagement ManagementEasy
A security firm has an ongoing five-year contract with a client that establishes payment terms, liability limits, and confidentiality obligations applicable to all future work. For each individual assessment, a separate document is created specifying the exact scope, deliverables, and schedule. What is the document that establishes the long-term overarching terms called?
- AMaster Service Agreement (MSA)
- BNon-Disclosure Agreement (NDA)
- CStatement of Work (SOW)
- DRules of Engagement (RoE)
Show answer & explanationAnswer & explanation
Correct answer: A. Master Service Agreement (MSA)
A Master Service Agreement (MSA) establishes the umbrella terms (payment, liability, confidentiality) that govern the ongoing relationship, while each SOW under the MSA defines project-specific scope and deliverables. The MSA does not need to be re-negotiated for every engagement.
Why the other options are wrong
- B. The NDA only addresses confidentiality, not payment or liability terms broadly.
- C. The SOW is the project-specific document, not the long-term overarching agreement.
- D. The RoE defines technical testing rules for a specific engagement, not the business relationship.
Master Service Agreement (MSA)
A long-term contract establishing overarching legal and business terms that apply to all future work between a client and vendor.
- Governs the ongoing relationship, not one project
- Individual SOWs are created under the MSA for each engagement
- Typically covers payment terms, liability, and confidentiality baseline
Memory trick: NASOR: NDA, Authorization, SOW, MSA, RoE — each document plays a role.