The next document for us to discuss is the MSA or the master service agreement.
The MS A is another legal document, and while the NDA is more of a cookie
cutter, boilerplate, standard type of document, the MSA discusses a number
of items related to the contract that you're about to establish between
yourself or your company and the client.
This document outlines the various terms and conditions
under which the work will be performed.
The details of the MSA include another confidentiality clause.
I have, in fact, seen some organizations use the MSA in lieu of an NDA.
More specific to the pen tester, the MSA outlines the
services that the pen tester performs.
Work standards such as the day of the week that work takes place, working
hours, as well as details about payment terms, what happens if the client is
late on the payment, and what penalties may be available to the pen tester if
the client or any third parties don't live up to their claims? Warranties and
indemnification is another section that helps establish protection for the
client and pen tester.
For example,
what happens if the pen tester destroys a server during an engagement
and it takes two weeks to bring it back online,
costing the company thousands of dollars in the process? The MSA may include
a provision that identifies that the pen tester is not responsible for this
type of disaster. Or what happens if the client sends in a scheduled
payment, but the pen tester doesn't perform the required work? How does the
client get their money back?
All of that is outlined in the warranty section.
Lastly,
there's the dispute resolution. Here we typically see a
waiver of certain rights and an agreement of which state and
court would hear the arguments.
This document can be several pages in length and can vary in style,
content, and detail. While you can probably find a sample online, in fact,
we're about to look at one, this is the type of document that
should be handled by a legal professional.