Establishing secure connection…Loading editor…Preparing document…

Business Services MSSP Addition

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS SERVICES MSSP ADDITION

Parties and Effective Date

This MSSP Addition (the "Addition") is entered into as of by and between:

Recitals

WHEREAS, Service Provider currently provides business services to Client under an existing written agreement titled "Business Services Agreement" (the "Agreement"); and

WHEREAS, Client desires to obtain from Service Provider certain managed security services and related professional services described herein, and Service Provider is willing to provide such services as an addition to the Agreement pursuant to the terms and conditions of this Addition;

WHEREAS, the parties intend that this Addition amend and supplement the Agreement only to the extent expressly provided in this document.

Scope of Work

Service Provider will provide managed security services and associated professional services (collectively, "MSSP Services") as described below. MSSP Services shall include continuous monitoring, threat detection, incident response coordination, managed firewall and endpoint management, security patch management, and periodic security reporting. Specific deliverables, service levels, and responsibilities are set forth in the scope below.

Payment Terms

In consideration for the MSSP Services, Client shall pay Service Provider the fees set forth below. All fees are exclusive of taxes unless otherwise stated.

Payments are due within days of invoice unless otherwise stated. Late payments shall incur a late fee of per month on the outstanding balance or the maximum permitted by law, whichever is lower.

Term and Termination

The term of this Addition shall commence on and shall continue until unless earlier terminated in accordance with this section.

Either party may terminate this Addition for convenience upon days' prior written notice to the other party. Either party may terminate immediately for material breach that remains uncured for a period of thirty (30) days after receipt of written notice specifying the breach. Termination of this Addition shall not relieve Client of its obligation to pay for services performed and expenses incurred prior to the effective date of termination.

Confidentiality

"Confidential Information" means any non-public information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party") that is identified as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes, without limitation, technical data, security configurations, incident reports, system architecture, customer data and pricing.

The Receiving Party shall (a) use the Confidential Information solely to perform its obligations under this Addition, (b) restrict disclosure to its employees, contractors and agents who have a need to know and are bound by confidentiality obligations no less protective than those set forth herein, and (c) take reasonable measures to protect the confidentiality of such information. Confidential Information does not include information that: (i) is or becomes publicly available other than through a breach by the Receiving Party; (ii) was rightfully in the Receiving Party's possession prior to disclosure; (iii) is rightfully received from a third party without restriction; or (iv) is independently developed without use of the Disclosing Party's Confidential Information.

The obligations in this section shall continue for a period of following termination or expiration of this Addition, except that trade secrets shall be protected for as long as they remain trade secrets under applicable law.

Representations and Warranties; Limitations

Each party represents and warrants that it has the full corporate power and authority to enter into this Addition and to perform its obligations hereunder. Service Provider warrants that MSSP Services will be provided in a professional and workmanlike manner in accordance with generally accepted industry standards. EXCEPT AS EXPRESSLY PROVIDED IN THIS ADDITION, SERVICE PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Indemnification

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims arising out of a party's gross negligence or willful misconduct in connection with this Addition. The foregoing indemnity obligations are subject to the indemnified party providing prompt written notice of any claim and reasonable cooperation in defense of the claim.

Notices

Governing Law

This Addition shall be governed by and construed in accordance with the laws of the State of without regard to its conflict-of-law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in that state for any disputes arising under this Addition.

Entire Agreement and Amendment

This Addition, together with the Agreement, constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes all prior and contemporaneous understandings and agreements, whether written or oral. Except as expressly modified by this Addition, all terms and conditions of the Agreement remain in full force and effect. This Addition may be amended only by a written instrument signed by duly authorized representatives of both parties.

Miscellaneous

If any provision of this Addition is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. The parties acknowledge that monetary damages may be inadequate to remedy a breach of the confidentiality or restrictive provisions and that injunctive relief may be sought in addition to any other remedies available at law or equity.

Service Provider Printed Name:

By:

Date:

Client Printed Name:

By:

Date:

Enter text✕

What the Business Services MSSP Addition Is

A Business Services MSSP Addition is an amendment to an existing services agreement that formally adds managed security services and responsibilities provided by a Managed Security Service Provider (MSSP). It defines scope of services, deliverables, service levels, security controls, data handling, reporting requirements, incident response obligations, pricing and payment terms, liability allocation, change control, and termination rights. The addition clarifies operational and compliance duties between parties so both vendor and customer understand expectations and risk allocation before security services begin.

Why an MSSP Addition Matters for Contracts

An MSSP Addition aligns technical security obligations with commercial terms, reduces ambiguity about incident response and data protection, and creates measurable SLAs and reporting. It helps organizations manage third-party risk and meet regulatory expectations for security controls and breach handling.

Why an MSSP Addition Matters for Contracts

Who Typically Prepares and Signs an MSSP Addition

Teams from both provider and customer prepare MSSP additions to ensure operational, legal, and compliance requirements are documented before services begin.

  • Security procurement teams and vendor managers who negotiate service scope and pricing and coordinate technical onboarding.
  • Legal and contracts teams that draft indemnity, liability caps, and data processing language to align with enterprise policies.
  • IT and security operations staff who define technical controls, logging, monitoring, and incident response procedures.

Final signatures are often executed by authorized signatories (CISO, VP of Procurement, or corporate counsel) after operations and legal reach agreement.

Core Sections to Include in a Professional MSSP Addition

A complete MSSP Addition groups commercial terms with technical obligations so responsibilities, metrics, and controls are enforceable and auditable.

Scope of Services

Precisely list monitoring, threat detection, attack mitigation, vulnerability scanning, patching responsibilities, and boundaries of the MSSP’s obligations to avoid scope creep and gaps.

Security Controls

Specify required controls (firewalls, endpoint detection, SIEM configuration, encryption, access controls), minimum baselines, and any standards the MSSP must meet.

Service Levels

Define measurable SLAs (detection time, response time, resolution targets, uptime) and the remedies or credits triggered by SLA failures.

Reporting & Metrics

Describe reporting cadence, required logs and retention, formats, dashboard access, and the content of incident and weekly/monthly reports.

Data Handling

Detail data classification, encryption-at-rest/in-transit requirements, secure transmission methods, and permitted uses of customer data.

Liability & Termination

Allocate indemnities, caps, confidentiality obligations, termination triggers (material breach, insolvency), transition assistance, and post-termination data return or destruction.

Step-by-Step: Preparing and Executing an MSSP Addition

Follow a structured workflow from drafting to execution to reduce negotiation cycles and ensure compliance with operational requirements.

  • 01
    Draft Amendment: Attach scope, SLAs, exhibits, and responsibilities clearly to the parent agreement.
  • 02
    Internal Review: Legal, security, procurement, and finance each review and mark required edits.
  • 03
    Counterparty Review: Share draft with vendor and resolve open points, focusing on controls and liability.
  • 04
    Execution: Collect authorized signatures, date the document, and circulate the executed copy to stakeholders.

Typical Online Workflow Settings for Digital Execution

Configure the online signing workflow to match your review, authentication, and archival requirements before sending the amendment.

Field Configuration
Authentication Email link or SMS code; choose stronger methods for high-risk agreements.
Conditional Fields Show payment or BAA fields only when applicable to reduce signer confusion.
Bulk Send Use for standardized addenda to many contracts; verify template tokens first.
Audit Trail Enable full event logging including IP, timestamp, and signer actions.

Where to Send and How to Store the Executed Addition

After execution, distribute copies to legal, security, procurement, and the MSSP onboarding team and store a signed PDF in the contract repository.

  • Send to Legal: Deliver the executed PDF and audit trail for contract file retention.
  • Share with Security: Provide incident response contacts and technical exhibits to security operations.
  • Upload to Repository: Archive in the contract management system with indexing and tags.
  • Notify Procurement: Confirm billing updates and trigger vendor onboarding steps.

Digital Signing and Technical Compatibility

Choose signing and storage platforms that support required authentication, audit trails, and the file formats you use.

  • Supported Formats: PDF, DOCX, and HTML
  • Integrations: Salesforce, NetSuite, Microsoft 365, Google Workspace, Box
  • Authentication: Email, SMS, KBA, or stronger MFA

Common Timeframes and Deadlines to Track

MSSP additions introduce operational deadlines and notice periods that affect onboarding, billing, and SLA measurement.

Effective Date:

Set as MM/DD/YYYY; SLAs typically start on this date.

Execution Deadline:

Agreed external deadline for both signatures; often 30 days from offer.

SLA Measurement Start:

Usually begins after implementation or defined handover period.

Termination Notice:

Commonly 30–90 days, depending on contract terms.

Review Cycle:

Quarterly or annual reviews for performance and control updates.

Key Milestones from Negotiation to Live Operations

Track milestones as discrete stages to coordinate legal sign-off, technical onboarding, and SLA activation.

01

Negotiation

Finalize scope, controls, and pricing with cross-functional stakeholders.

02

Execution

Collect authorized signatures and record the effective date.

03

Implementation

Enable monitoring, escalate paths, and hand over credentials or access.

04

Operational Review

Validate SLAs, reporting, and incident response effectiveness after go-live.

Common Preparation Errors to Avoid

  • Leaving scope vague and relying on generic descriptions that cause disagreements about responsibilities.
  • Omitting specific SLAs or metrics so response obligations cannot be measured or enforced.
  • Failing to address data classification and cross-border transfer rules for log and telemetry data.
  • Using unsigned exhibits or failing to attach referenced technical schedules that define deliverables.

Consequences of an Incorrect or Incomplete MSSP Addition

Operational Gaps: Unclear duties lead to monitoring failures
Compliance Exposure: Regulator scrutiny or audit findings
Financial Loss: Unallocated incident costs
Contract Disputes: Delayed remediation and legal fees
Data Breach Risk: Improper handling of logs or PHI
Termination Costs: Transition and notice penalties

Real-World Examples of MSSP Addenda in Practice

These examples show how organizations use additions to formalize security responsibilities and simplify signature collection across teams.

Optica Ventures — Brian Fitzgibbons

Optica centralized monitoring and vendor obligations into a single MSSP addendum to reduce ambiguity during onboarding.

  • The addendum clarified SLAs.
  • "The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers."

Tech Data — Bob Dutkowsky

Tech Data used a standardized security addendum to accelerate contracting for managed services across business units.

  • Standard templates reduced approval time.
  • "Tech Data uses airSlate SignNow to improve our internal and external customer service while increasing our speed to revenue."

Who Has Authority to Sign an MSSP Addition

Chief Information Security Officer

The CISO often approves technical scope and attests that security controls meet enterprise requirements. Depending on corporate policy, the CISO may sign or must delegate signature authority to a named executive or procurement officer.

Authorized Signatory

An officer with delegated contracting authority (e.g., VP Procurement or General Counsel designee) must sign to bind the organization. Ensure delegation is documented and retained with the contract files.

Security and Compliance Defaults to Document

Encryption: TLS 1.2/1.3 in transit
At-Rest: AES-256 encryption at rest
Certifications: SOC 2 Type II, ISO 27001
HIPAA: BAA required for PHI
Audit Trail: Detailed event logging
Accessibility: WCAG 2.0 Level AA

eSignature Pricing and Feature Snapshot

Comparison of common eSignature providers and feature differences relevant to executing MSSP additions. signNow is listed first per standard vendor comparison.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies by plan Varies by plan Limited trial Limited trial
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year Varies Varies Varies

Frequently Asked Questions and Troubleshooting

Answers to common questions about signing, notarization, and operational steps when adding MSSP services to a contract.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users