Scope of Services
Precisely list monitoring, threat detection, attack mitigation, vulnerability scanning, patching responsibilities, and boundaries of the MSSP’s obligations to avoid scope creep and gaps.
An MSSP Addition aligns technical security obligations with commercial terms, reduces ambiguity about incident response and data protection, and creates measurable SLAs and reporting. It helps organizations manage third-party risk and meet regulatory expectations for security controls and breach handling.
Teams from both provider and customer prepare MSSP additions to ensure operational, legal, and compliance requirements are documented before services begin.
Final signatures are often executed by authorized signatories (CISO, VP of Procurement, or corporate counsel) after operations and legal reach agreement.
Precisely list monitoring, threat detection, attack mitigation, vulnerability scanning, patching responsibilities, and boundaries of the MSSP’s obligations to avoid scope creep and gaps.
Specify required controls (firewalls, endpoint detection, SIEM configuration, encryption, access controls), minimum baselines, and any standards the MSSP must meet.
Define measurable SLAs (detection time, response time, resolution targets, uptime) and the remedies or credits triggered by SLA failures.
Describe reporting cadence, required logs and retention, formats, dashboard access, and the content of incident and weekly/monthly reports.
Detail data classification, encryption-at-rest/in-transit requirements, secure transmission methods, and permitted uses of customer data.
Allocate indemnities, caps, confidentiality obligations, termination triggers (material breach, insolvency), transition assistance, and post-termination data return or destruction.
| Field | Configuration |
|---|---|
| Authentication | Email link or SMS code; choose stronger methods for high-risk agreements. |
| Conditional Fields | Show payment or BAA fields only when applicable to reduce signer confusion. |
| Bulk Send | Use for standardized addenda to many contracts; verify template tokens first. |
| Audit Trail | Enable full event logging including IP, timestamp, and signer actions. |
Choose signing and storage platforms that support required authentication, audit trails, and the file formats you use.
Set as MM/DD/YYYY; SLAs typically start on this date.
Agreed external deadline for both signatures; often 30 days from offer.
Usually begins after implementation or defined handover period.
Commonly 30–90 days, depending on contract terms.
Quarterly or annual reviews for performance and control updates.
Finalize scope, controls, and pricing with cross-functional stakeholders.
Collect authorized signatures and record the effective date.
Enable monitoring, escalate paths, and hand over credentials or access.
Validate SLAs, reporting, and incident response effectiveness after go-live.
Optica centralized monitoring and vendor obligations into a single MSSP addendum to reduce ambiguity during onboarding.
Tech Data used a standardized security addendum to accelerate contracting for managed services across business units.
The CISO often approves technical scope and attests that security controls meet enterprise requirements. Depending on corporate policy, the CISO may sign or must delegate signature authority to a named executive or procurement officer.
An officer with delegated contracting authority (e.g., VP Procurement or General Counsel designee) must sign to bind the organization. Ensure delegation is documented and retained with the contract files.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by plan | Varies by plan | Limited trial | Limited trial |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies | Varies | Varies |