Common agreements.
In this video,
we're going to discuss common types of agreements
that are used in our enterprise networks.
Some common agreements
are things like non-disclosure agreements, or NDAs;
a memorandum of understanding, or MOU;
and a service-level agreement, an SLA.
First, we have non-disclosure agreements, or NDAs.
Now, a non-disclosure agreement
is a documented agreement between two parties
that define what data is considered confidential
and cannot be shared outside of that relationship.
Now, NDAs are often used by organizations
to protect their intellectual property,
and they're either going to be
between two different organizations
or between an organization and its employee.
Now, why would an organization
require their employee to sign an NDA?
Well, it's because those NDAs
can be a form of non-competitive clauses
inside of an employment agreement,
or the company might fear that that employee
might take the information
they're learning from the organization
and go off and start their own business
or disclose it to their competitors.
Now, if two organizations are working jointly
on a project, system or network,
they can also utilize a non-disclosure agreement.
This allows the companies
to share the type of data they need to
in order to develop this product
without fear that the other company
is going to steal their trade secrets.
Keep in mind, though, a non-disclosure agreement
is an administrative control, not a technical control.
There is nothing in the system
that is going to prevent one of these people
from sending data to the others if all you have is an NDA.
You only have the word and signature on that piece of paper
that promises not to do it.
Now, if you want to get some technical controls
involved with an NDA,
you can do that using a DLP, or data loss prevention system.
But the DLP is the technical control,
not the NDA, in that case.
An NDA is considered a legally binding agreement,
and it carries penalties for breaking the NDA,
including fines, forfeiture of intellectual property rights,
or even jail time in some extreme circumstances.
Next, we need to discuss an MOU,
or memorandum of understanding.
A memorandum of understanding
is a non-binding agreement between two or more organizations
to detail what common actions they intend to take.
Essentially, this is a formal version
of a gentleman's agreement,
because it's actually written down
and signed by both parties
and it isn't really legally enforceable.
Essentially, this is like a handshake deal,
but slightly more formalized
because we wrote it down and we both signed it.
For example, if you and I both agree
that we were going to go into business together
on a joint project,
we could create an MOU that outlines what things
each of us is going to be responsible for doing.
So you might say that you're going to do A, B, and C;
and I'm going to handle X, Y, and Z.
We would write that down inside of an MOU.
We could sign it,
and then, at any time, we could look back on that document
if we have a disagreement in the future and say,
"But hey, you said you were going to handle item B,
"and I said I was going to handle item Y.
"But if I didn't do item Y,
"you can't sue me just because I didn't finish it,
"because this agreement is non-binding."
Now, a memorandum of understanding
is often referred to as a letter of intent
because, again, it's an intent to do something,
it's not a requirement to do it.
It's often going to be used within an organization
by two or more smaller internal divisions
because of this non-binding legal status.
So for example, I used to be the director
of an IT department for a really large organization,
and I was responsible for managing the service desk
as part of my responsibilities.
Now, my service desk provided assistance
to several thousand employees across multiple countries.
There was one critical business unit
that wanted to have at least one tier two service desk agent
located in their specific building at all times
because their building was a little bit further away
than our headquarters was.
Now, this way, if something went offline in the network,
that tier two agent didn't have to get in their car
and drive from the headquarters to this branch office,
which was about an hour away.
And that way, they could immediately start
the restore process
because they're already sitting in the building.
Now, I thought this was a pretty good idea,
so we agreed to it and we wrote up an MOU.
The leader of that part of the organization and I
both wrote down what we were going to do.
I said, I'm going to provide
one full-time tier two service desk agent,
and I'm going to have them do all their daily functions
out of your building.
In return, they said they would provide my tier two agent
with a small office and a dedicated parking spot.
We both wrote all this up, we put it in the MOU,
and we signed it.
This way, we were able to minimize the time to repair
for lots of critical issues
that happened at this business unit
because the guy was already sitting in that building
as a tier two agent.
Now, this wasn't a binding agreement on either of our parts.
Any time I could have said, you know what,
I think I need Tom to come back to the main office,
and I can't have him sit in your office
five days a week anymore.
Or, maybe I need to have Tom work out of the headquarters
for Mondays and Tuesdays,
but on Wednesday, Thursday and Friday,
he can work in your unit.
Now, the other business unit leader couldn't really complain
because he had no way of forcing me
to keep Tom in that building
for all 40 hours every single week
because we had this MOU, which is non-binding.
Now, this MOU does give us some formality
to our agreement that we had made between the two directors.
This was the director of operations
and myself, as the IT director.
But at any time, we could modify it or break it
without any serious consequences.
As I said, MOUs are usually used internally
between two business units, as in my previous example,
but they can also be used externally
between your organization
and one or more other organizations.
There are some consortiums out there
that have multi-party MOUs
with five or six or seven organizations
that all come together
to do a common thing or a common goal.
But remember, it is not legally binding
when you're dealing with MOUs,
so at any time,
these partner organizations could simply leave,
and there'd be no consequences.
Next, we have a service-level agreement, or SLA.
Now, a service-level agreement is a documented commitment
between a service provider and a client
where the quality, availability and responsibilities
are agreed upon by both parties.
Service-level agreements are primarily concerned
with the ability to support
and respond to problems within a given timeframe
while providing the agreed upon level of service
to your end users.
If you work in the IT service management realm already,
you are probably already familiar with SLAs.
SLAs are going to be used to provide a written agreement
for not only the security priorities,
but also, more importantly, your operational priorities.
It also is going to outline the responsibilities,
guarantees, and warranties
for a given service and its components.
For example, in one of my previous organizations,
we didn't want to keep a bunch of extra switches
and routers in our supply closet
in case one of them broke.
This would be really expensive,
all this extra gear just sitting there.
So we opted to have a service-level agreement
in place with our supplier,
and that agreement said if a router or switch failed
and we couldn't get back online within 10 minutes,
they would bring us a new device
within four hours of the outage.
Now, these service-level agreements
can really help bring some predictability
to an otherwise hard-to-predict area,
like, when will a device fail?
SLAs can be really good in this case,
but only if your service provider
is going to live up to their end of the agreement.
Now, another place you're often going to see SLAs
is in regard to your internet connections
or when dealing with internet service providers
or cloud service providers.
For example, my internet service provider
has a service-level agreement with us
that states they're going to maintain an uptime of 99.999%,
which equates to having no more
than five minutes of downtime per year.
Now, because it's a service-level agreement,
if they don't meet that uptime requirement,
what's going to happen?
Well, that depends on your agreement
and your underlying contracts.
In our contract, we actually get a refund
for the entire monthly service fee
if they can't maintain the uptime
they promised in their SLA.
This is their penalty for not meeting the SLA,
and it works essentially like a fine
that they pay back to us.
Some contracts have these and some contracts don't.
It just depends on how you negotiate your deal.
So remember, when it comes to agreements
used in our network management,
we have three main types.
We have non-disclosure agreements,
memorandums of understanding,
and service-level agreements.