Contracts with ICT providers must contain a set of mandatory terms on service levels, security, access and exit. Contracts supporting critical or important functions need extra terms, such as participation in testing and detailed exit arrangements.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Compare current contracts against the mandatory terms
- Plan renegotiation for contracts with gaps
- Use a standard clause set for new contracts
Making it stick
Large providers often have DORA addenda ready. Ask for them. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.