-: Whenever you're dealing
with vendors outside your organization,
you're going to need to have some agreements
and contracts in place.
That's what we're going to talk about in this lesson.
We're going to discuss NDAs, MOUs, SLAs, ISAs, and BPAs.
The first is an NDA.
An NDA is a non-disclosure agreement,
and it's an agreement between two parties
that define what data is considered confidential
and can't be shared outside of that relationship.
NDAs are often used by organizations
to protect their intellectual property,
and they're either between different organizations
or between an organization and their employees.
Now why would an organization require their employee
to sign an NDA?
Well, it's because those NDAs can be a form
of a non-competitive clause inside the employee contract.
And this is because companies might fear
that their employee might take the information
they learned from that organization
and then go off and start their own business.
Now when two companies are working jointly
on developing a product, they can also use an NDA.
This allows the companies to share
the type of data they need in the development of the product
without fear of the other company
stealing their trade secrets.
Now NDAs don't prevent data from being shared
through a technical control,
instead this is an administrative control.
This is because the NDA states
the penalties for breaking the NDA,
which may include fines,
forfeiture of intellectual property rights,
or even jail time in some extreme circumstances.
NDAs are considered legally binding
and they are a legally-binding agreement.
They can be upheld through contract law
inside of a court of law.
Next we have MOUs.
MOUs are a memorandum of understanding.
And this is a non-binding agreement
between two or more organizations
to detail what common line of action
they're intending to take.
Now essentially, this is a formal version
of a gentlemen's agreement
because it's actually written down
and signed by all parties.
But it's pretty much like a handshake, right?
If you and I agreed to go into business together
and I understand you're going to do x, y, and z,
and you understand that I'm going to do a, b, and c,
that's what an MOU does.
An MOU is often referred to as a letter of intent,
and it's most often used within an organization
by two of its smaller internal divisions.
For example, in one of my past jobs,
I was in a large organization
and I was the director of the IT department
and we managed the service desk.
Now my service desk provided service
to several-thousand employees across multiple countries.
We had an MOU in place with one critical business unit
that would say that we would have
at least one field service technician
embedded at their offices,
so that if something went down,
that person didn't have to get in the car
and drive to their office, they were already there.
This helped minimize the time to repair the issues
that popped up at any time.
Now this wasn't a binding agreement on our part
and at any time, I could have said, you know what,
I need Tommy to come back to the main office
and he can't sit in your office anymore,
but this agreement, this MOU,
gave us some formality to the agreement that was made
between their director of the operations
and myself as the IT director.
Now, while MOUs can be used internally
between two business units, as in my example,
they can also be used externally
between your organization
and one or more other organizations.
There are some consortiums
where they have a multiparty MOU
where you might have five or six
or seven people come together for a common goal.
But remember, it is not legally binding
when you're dealing with MOUs.
Another business document to consider using
is what's known as a service-level agreement or SLA.
Now this agreement is concerned with the ability
to support and respond to problems within a given timeframe
while providing the agreed upon
level of service to the user.
If you work in the IT service management realm,
you're probably very familiar with SLAs.
SLAs are used to provide a written agreement
for not only the security priorities
but more importantly, those operational priorities.
It also outlines the responsibilities, guarantees,
and warranties for a given service and its components.
For example, in one of my previous organizations,
we didn't want to have to keep a bunch of extra switches
and routers in our supply closet
because we don't want to have that expense
for them just sitting on the shelf.
So instead we had a service-level agreement in place
with our supplier that said if we lose a router or a switch
and it goes down, they would bring us a brand new one
within four hours of the outage.
These service-level agreements
can help to bring some level of predictability
to an otherwise hard-to-predict area.
That is, of course, if your service provider
lives up to their end of the agreement.
Now, another place you're often going to see SLAs
is in regard to your internet connections or your ISP.
For example, my internet service provider
has a service-level agreement with us
that states they're going to maintain an uptime of 99.999%,
and that equates to having
no more than five minutes of downtime per year.
Now, because it's a service-level agreement,
if they don't meet that 99.999% uptime, what happens?
Well, that depends on your agreement
and your underlying contracts.
Some contracts have penalties for not meeting your SLAs,
and some don't.
Next let's talk about information sharing.
Often, multiple organizations want to work together
and that requires them to share information
between their networks.
An agreement that focuses on connecting two systems
from two different organizations
is called an interconnection service agreement or ISA.
An ISA is an agreement that allows
the owners and operators of the two IT systems
to document what technical requirements
each organization has to meet.
If your organization is planning to connect
its network to another organization,
it's a good idea to ensure
you have an interconnection security agreement in place
detailing exactly what level of security
each organization needs to meet.
So what's a good example
of an interconnection service agreement?
Well, one good place to use this
would be if you have your heating and air provider
who wants to be able to connect their systems
to remotely diagnose their heating and air system
remotely over your network.
Now if they want to do that,
they don't want to have to go
and install their own network line,
bring their whole ISP to be able to connect
to the air conditioning system.
So they may say, hey, can we plug in
this air conditioning system into your network
and ride your network back out to the internet
and use it as transport?
Well, they can do this if you decide to allow them
and you guys have an ISA in place.
You could put an ISA in place
that says their data is going to be encrypted,
tunneled over a VPN, and use your network
for transport only, and they have to meet x, y, and z level
of security before you're going to allow them to plug in.
Now if you're going to do something like this,
you need to think through
all of the security effects to it
because any time you allow somebody else
to plug into your network,
whatever vulnerabilities they have
are going to be inherited by your network.
Next we have a business partnership agreement or a BPA.
Now business partnership agreement
is conducted between tow business partners
that establishes the conditions of their relationship.
These include things like each person's responsibility
as well as the revenue, system, and data sharing details.
One example of this is my company.
We entered into a business partnership agreement
with another company to produce an online training course
on the CompTIA Advanced Security Practitioner or CASP+ Exam.
Now in our agreement, it clearly stated
that I was responsible for writing all of the scripts
and all of the videos,
flying out to their studios to film it,
but my partner was responsible
for providing me travel expenses.
They had to provide a production crew to film the course
and then they had to be responsible for all of the editing
and post-production and marketing work.
This agreement stated
that I would get x percent of the sales
and they would be able to keep y percent of the sales,
and it also outlined whether or not
I could create a competing video-based course
covering that same certification.
So to answer a question I get a lot from my students,
no, you can't find my CASP+ course on anywhere
except for LinkedIn Learning
because of this BPA we have in place with them,
said we would make the course exclusive to their platform.
So for that reason, you're not going to find my CASP+ course
on my own site, diontraining, or any other site out there.
Now in addition to all the contractual obligations
that are outlined in the business partnership agreement,
you can also include language in that agreement
that talks about the security that each organization
has to maintain for their networks
and the shared data and resources of the partnership.
For example, if your organization doesn't allow
the use of removable media,
you could specify in the partnership agreement
how your files are going to be delivered to you
and that might be through a cloud storage provider
or some other technical means.
All of that can be covered inside of your BPA.
(electronic music)