SOW

An MOA can be used for arrangements with parties outside the organization, but that is not common business practice. SOWs are used between businesses to record what kind of work will be done and which deliverables are expected.

The communication here isn't limited to the work the team will do, but also must at a minimum discuss compensation, possibly some of the tactics, and other communication requirements. The construct and specificity of the SOW will depend on what each party wants the document to say. For example, it could just state that a forensics/threat-hunting company will perform forensics services for up to a certain amount of money. An SOW will almost always have a set amount of money for the threat-hunting firm to spend—this is because it's a commercial agreement. Open-ended engagements are not common within the cybersecurity industry because teams can always keep hunting due to the never-ending supply of data, but no organization has the funds...