What is a memorandum of agreement?
A memorandum of agreement (MOA) is a document in which two or more parties set out the specific responsibilities each one accepts for a joint effort and the conditions attached to them. Where a memorandum of understanding records shared intent, an MOA records commitments: who provides staff, systems or funding, what each side must do and by when, and what happens if a party wants out. MOAs are common between government agencies, and between public bodies and the universities or organizations they work with outside a standard purchase.
What an MOA spells out
- The specific duties of each party, often as a numbered list per party
- Resources each party contributes, such as staff, equipment, facilities or money, and how costs are shared
- Conditions and dependencies, for example that one party's work starts only after the other grants access
- Security requirements for shared systems and data, or a reference to a separate technical agreement
- Reporting duties, including how fast each side must report an incident that affects the other
- Duration, review dates, dispute handling and termination
Example: a shared SIEM
A county runs a security information and event management platform and agrees to monitor logs for three small towns. The MOA states that the county hosts and patches the platform and staffs the monitoring desk during business hours. Each town forwards its firewall and server logs over an encrypted connection and names a contact who can be reached around the clock. Analysts may view only the logs of the town they are investigating. The county notifies the affected town within four hours of confirming an incident, and each town pays a share of the license cost based on its log volume. Every line assigns a duty to a named party, which is what separates an MOA from an MOU.
How binding is an MOA?
An MOA is more formal than an MOU and more likely to be enforceable, but its title does not settle that; the wording and the law that applies do. Some government bodies reserve the MOA for arrangements in which one party pays or commits resources to another, and use an MOU when nothing of value changes hands. When systems are connected under an MOA, the technical controls for the link, such as encryption, authentication and monitoring, are often documented separately in an interconnection security agreement.
MOA vs. MOU vs. SOW
- MOA: specific duties and conditions for cooperating parties, often without a buyer and seller.
- MOU: shared goals and intent to cooperate, generally not binding.
- SOW: the scope, deliverables, schedule and price of one paid project, usually under a master service agreement.
Memorandum of agreement on the CompTIA Security+ exam
SY0-801 names the MOA among the agreement types under objective 5.3, the objective on third-party risk. A scenario that says partners must define "the responsibilities of each party," "specific conditions" or "who will provide which resources" points to an MOA. The MOU is the tempting wrong answer, because both documents describe cooperation; the difference is that an MOU stops at intent while an MOA states obligations. If the scenario describes a vendor delivering a paid project, the answer is more likely a SOW, and if it describes guaranteed uptime with penalties, an SLA.