The CISO is making arrangements to outsource some areas of organizational security to a security service provider. She wants to document specific notification time limits for security incidents and include penalties for failure to meet those specifications.

Which of the following types of agreements is most likely to contain formal requirements of this type?