How do we review our existing ICT contracts against DORA's contract terms and decide what to do about each gap?

Start

We signed ICT contracts before DORA applied and have not checked them

DORA applies from 17 January 2025 and has no clause that exempts earlier contracts. Many financial entities hold contracts signed before then, and many were written on the provider's standard terms. This question is a review of the signed portfolio, contract by contract. Choosing clauses for a new contract is a different question.

• Then: Do we know DORA binds us as a financial entity?

Decision

Do we know DORA binds us as a financial entity?

The contract duties fall on the financial entity. A supplier does not run this review; it answers its customer's request. If you are not sure whether you are in scope, settle that first.

• Yes: List every ICT contract, including small, free and intra-group ones
• No, or not known: Settle what you are first; a supplier answers its customer instead

Outcome

Settle what you are first; a supplier answers its customer instead

Run the scope assessment to learn whether DORA binds you. If you supply ICT services to a financial entity, use the supplier question and the flow-down list. Return here once you know you are the financial entity.

Step

List every ICT contract, including small, free and intra-group ones

Start from the register of information, which must hold every contractual arrangement for ICT services, not only the large ones. A small software subscription is a contract for an ICT service. Note for each the provider, the function it supports and its end date.

• Then: Check the contract against the terms every ICT contract needs

Step

Check the contract against the terms every ICT contract needs

The contract must be in writing with the service levels in one document, and must describe the services and whether subcontracting is allowed, give the locations of services and data, cover data protection and data return on insolvency or termination, give incident assistance, require cooperation with authorities, set termination rights and notice periods, let you end the contract for a significant breach, for circumstances found in monitoring that could change how the service performs, for evidenced weaknesses in the provider's ICT risk management, or if your authority can no longer supervise you, and cover training. Mark each present, partial or missing.

• Then: Does it support a critical or important function, or one not assessed?

Decision

Does it support a critical or important function, or one not assessed?

The function list decides. A contract whose function is not yet assessed is treated as supporting a critical or important function until it is. Not known takes the yes branch, because the extra terms are the ones a supervisor tests first.

• Yes, or not known: Add the extra terms for critical or important functions
• No: Is any required term missing or weaker than required?

Step

Add the extra terms for critical or important functions

These add full service levels with precise targets, notice and reporting duties on developments that could affect the service, the provider's own contingency plans and security measures, taking part in your threat-led testing, full cooperation in inspections and audits, unrestricted access, inspection and audit rights, and an exit strategy with a mandatory transition period. Mark each present, partial or missing.

• Then: Can the provider subcontract any part of that service?

Decision

Can the provider subcontract any part of that service?

If it can, the contract should name which services may be subcontracted and on what conditions, keep the provider responsible, pass down the same access and audit rights, and require notice of material changes with time for you to object. Delegated Regulation 2025/532 (Articles 3 to 6) sets these out, and only for services that support a critical or important function or a material part of one. You reach this question only for those contracts. Not known takes the yes branch.

• Yes, or not known: Check the subcontracting conditions as well
• No: Is any required term missing or weaker than required?

Step

Check the subcontracting conditions as well

Apply this only to a service that supports a critical or important function or a material part of one (Delegated Regulation 2025/532, Articles 3 to 6); other contracts skip it. Compare the clause with the conditions: responsibility for subcontracted services, monitoring and reporting, equal access and audit rights, notice of material changes and a notice period to object, and a right to provide for termination if the provider goes ahead over your objection. Check the current text for amendments.

• Then: Is any required term missing or weaker than required?

Decision

Is any required term missing or weaker than required?

A partial term counts as a gap. Compare the words, not the heading, as a clause called audit rights that lets you audit once a year at the provider's discretion is not the unrestricted right the list asks for. Not known takes the yes branch.

• Yes, or not known: Rank the gaps, critical or important contracts first
• No: Record the result and the date in the register

Step

Record the result and the date in the register

Record that you checked it, against which list and on what date. Keep the contract and your marked-up checklist together. The result holds until the contract or the function changes.

• Then: Is there another contract to review?

Step

Rank the gaps, critical or important contracts first

Enter each gap in the gap tracker with an owner and a date. The pack treats a binding duty that is not in place at all as a blocking gap, with the shortest default deadline. Start with audit and access rights, exit, incident assistance and subcontracting on the contracts behind critical or important functions.

• Then: Will the provider agree to an amendment now?

Decision

Will the provider agree to an amendment now?

Ask for an addendum that adds the missing terms. Some providers have a DORA addendum ready. Ask whether it covers every term on your list, not only the ones it prefers. Not known takes the no branch until the provider has answered in writing.

• Yes: Sign an addendum with the missing terms and a dated plan
• No, or not known: Escalate a refusal or silence, record the gap and plan the alternative

Step

Sign an addendum with the missing terms and a dated plan

Use the clause library for wording and have Legal check the result against the full text of the Regulation. Agree and document the timeline in which the provider makes any change in practice. Do not wait for the next renewal unless you can explain why to a supervisor.

• Then: Re-check the signed text and update the register and exit plan

Step

Re-check the signed text and update the register and exit plan

Check the final wording against the lists, not the term sheet. Update the register fields the contract feeds, such as notice periods, and the exit plan for a critical or important contract. Close the gap in the tracker with the date.

• Then: Is there another contract to review?

Step

Escalate a refusal or silence, record the gap and plan the alternative

Ask the provider for a written answer if it has not given one. Take the refusal or silence to the owner of the arrangement and Legal. Record the gap as open, with the reasons and the options: keep pressing at a more senior level, plan to replace the provider, or accept the gap openly while you do. Tell the management body. Do not describe the contract as compliant.

• Then: Is there another contract to review?

Decision

Is there another contract to review?

Work through the portfolio in order of the functions it supports. A contract with a short remaining term can be reviewed when you decide whether to renew it, but it still needs to be checked.

• Yes: Check the contract against the terms every ICT contract needs (back to an earlier step)
• No: Is any gap on a critical or important contract still open?

Decision

Is any gap on a critical or important contract still open?

The management body should hear of open gaps on contracts behind critical or important functions, with the owner and date for each. Counts with the gaps named are the pack's way of reporting this, with no scores or percentages.

• Yes: Report the open gaps to the management body and Legal
• No: Every contract reviewed, with each gap owned and dated or closed

Outcome

Report the open gaps to the management body and Legal

Give counts and name the gaps, the contracts and the dates. Ask the management body to decide what it will accept while they are open. Do not say the firm complies with the contract rules, and tell your authority if it asks.

Outcome

Every contract reviewed, with each gap owned and dated or closed

Keep the checklists, addenda, tracker entries and dates. A closed review shows what you checked and when. It does not show that your providers comply with DORA or that the contracts will never need changing again.