What is a memorandum of understanding?
A memorandum of understanding (MOU) is a written record of what two or more parties intend to do together. It describes a shared goal, the general contribution each side expects to make and how they will coordinate, without creating the enforceable obligations of a contract. MOUs are common where no purchase is involved: between government agencies, between departments of one large organization, between universities and public bodies, and between companies that agree to cooperate before negotiating a formal deal.
What an MOU usually contains
- The parties and the purpose of the cooperation
- The activities each party expects to carry out, described in general terms
- Points of contact and how the parties will communicate
- How long the understanding lasts, when it will be reviewed and how either side can withdraw
- A statement that no money changes hands and that the document creates no binding obligations
- How any shared information will be protected, sometimes by reference to an NDA
MOUs in security work
Security teams meet MOUs most often in information sharing and mutual aid. Several hospitals in one region might sign an MOU agreeing to exchange indicators of compromise and to lend incident responders to each other after a ransomware attack. A state agency and a city might use one to coordinate election security monitoring. When two organizations plan to connect their systems, an MOU or MOA can record the business reasons for the exchange, while a companion document such as an interconnection security agreement covers the technical controls. NIST SP 800-47 lists both kinds of document among the agreements U.S. federal agencies use to govern information exchanges between systems.
Is an MOU legally binding?
Usually not, and that is why parties choose it. The title alone does not decide the question, though. If an MOU contains the elements of a contract, such as firm promises, an exchange of value and language showing the parties meant to be bound, a court may enforce it whatever it is called. Well-drafted MOUs say plainly which sections, if any, are binding. Confidentiality terms are a common exception that the parties do want enforced, which is one reason an NDA is often signed alongside the MOU.
MOU vs. MOA vs. contract
| Document | Records | Typically binding? |
|---|---|---|
| MOU | Shared intent and general cooperation | Generally no |
| MOA | Each party's specific responsibilities and conditions | More often, depending on wording |
| MSA, SOW, SLA | Purchased services, deliverables and service levels | Yes |
Memorandum of understanding on the CompTIA Security+ exam
SY0-801 lists the MOU among the agreement types under objective 5.3, which covers managing the risk of vendors and partners. Scenario wording such as "document their intent to cooperate," "share threat information," "no legal obligation" or "no payment involved" points to an MOU. The closest distractor is the MOA, which assigns specific duties and conditions; if the scenario says who must do what, choose the MOA. An NDA protects information that is shared, an SLA commits to measurable service levels with penalties, and an MSA sets standing legal terms for paid work, so none of them fits a simple statement of shared goals.