Scope of Services
Describe tasks, responsibilities, hours, and technical boundaries in detail, including excluded services and escalation paths to avoid scope creep.
A well-drafted Co-Managed Services Agreement clarifies responsibilities, reduces operational risk, and establishes measurable service levels while preserving client control. It supports regulatory compliance by allocating data protection, breach notification, and retention duties between parties and references applicable law such as ESIGN and UETA for electronic execution.
Use the agreement when ongoing collaboration, shared privileges, or regulatory obligations require written allocation of duties.
Describe tasks, responsibilities, hours, and technical boundaries in detail, including excluded services and escalation paths to avoid scope creep.
Define explicit owner for each activity, access rights, change control steps, credential handling, and conditions for transferring responsibilities.
Specify measurable metrics (MTTR, uptime, response SLAs), reporting cadence, remedies for violations, and how credits or penalties are calculated.
Allocate data protection duties, encryption standards, breach notification timelines, and requirements for HIPAA, PCI, or other applicable regimes.
Document privileged access processes, least-privilege rules, account provisioning/deprovisioning, multifactor requirements, and auditing responsibilities.
Plan offboarding, data return/destruction, transitional support, and any carryover obligations to ensure continuity at contract end.
| Workflow Element | Recommended Setting |
|---|---|
| Signer Order | Sequential by role |
| Authentication Level | Email + SMS code |
| Required Fields | Full name, title, date |
| Audit Trail | Enabled with timestamps |
Ensure the chosen platform supports ESIGN/UETA compliance, audit trails, and any industry-specific requirements such as HIPAA BAAs.
Finalize redlines before the proposed go-live date.
When all parties have signed; obligations begin.
Typically 30–90 days before renewal.
Often 30–90 days depending on contract terms.
Specify days of ramp-down support after termination.
Export the final contract as a PDF/A file with embedded audit trail for immutable long-term storage and compliance.
Attach network diagrams, access lists, and SLAs as appendices in PDF or DOCX to avoid ambiguity.
Include any required BAAs, SOC reports, or certification summaries that demonstrate compliance commitments.
Provide an offboarding transition document that lists transfer tasks, data export formats, and timelines.
Authorizes strategic technology relationships and signs on behalf of the organization when agreements affect enterprise operations and budgets.
Signs operational contracts within delegated authority after legal and security review when procurement terms and payment obligations are involved.
Ensure all fields and exhibits are complete before notarization.
Decide between in-person notarization or RON depending on state allowance.
Use ID credential analysis, KBA, or multifactor checks for RON.
For RON, preserve session recording per state rules.
Notary signs and stamps where statutes require acknowledgment.
Collect witness signatures when state law or document requires them.
Notary records event in a journal for future verification.
Provide all parties with an executed and notarized copy for records.