A plain-English checklist of the provisions DORA requires in ICT contracts, the extra ones for critical or important functions, and where older agreements usually fall short.
The Digital Operational Resilience Act has applied since January 2025, and most financial entities have now built their first register of information. The register is the visible part. The harder part sits underneath it: Article 30, which sets out what every contract with an ICT provider has to contain.
Here is what it asks for, in plain English, and where older agreements tend to fall short.
For every ICT service: Article 30(2)
Every contract for ICT services should include:
- 01A clear description of the functions and services, and whether the provider may subcontract them (and on what terms).
- 02The locations, by region or country, where the services are provided and data is processed and stored, and a duty to tell you before any of those change.
- 03Provisions on the availability, authenticity, integrity and confidentiality of data, personal data included.
- 04How you get your data back, in an accessible format, if the provider becomes insolvent, stops trading or the contract ends.
- 05Service level descriptions, including how they are updated.
- 06An obligation to help when there is an ICT incident related to the service, at no extra cost or at a cost agreed upfront.
- 07An obligation to cooperate fully with competent and resolution authorities.
- 08Termination rights and minimum notice periods.
- 09The conditions for the provider taking part in your ICT security awareness and resilience training.
For critical or important functions: Article 30(3)
Where the service supports a critical or important function, the contract also needs:
- Full service level descriptions with precise quantitative and qualitative targets.
- Notice periods and reporting duties, including telling you about anything that could materially affect the service.
- Business contingency plans, tested, and appropriate ICT security measures.
- Participation in your threat-led penetration testing.
- Unrestricted rights of access, inspection and audit, for you, someone you appoint, and the regulator.
- Exit strategies, with a mandatory transition period so you can move to another provider or bring the service in-house.
Where agreements fall short
Contracts signed before DORA was in view were usually written for a different purpose. They describe the service and the price well, because that is what the parties negotiated. The gaps tend to be in the provisions nobody needed until a regulator asked:
- Locations. Many contracts say where data is stored but not where the service is delivered from, and very few oblige the provider to give notice before that changes.
- Incident assistance. Help during an incident is often promised, but the cost is left open, and Article 30 wants it settled in advance.
- Exit. Termination clauses exist; a defined transition period, during which the provider keeps the service running, often does not.
Making it manageable
Three things make the work smaller. Check the contract family, not the master agreement alone: the answer to a requirement is often in a later amendment or a data processing addendum. Start with the services that support critical or important functions, because that is where the longer list applies and where supervisors will look first. And when you find a gap, fix it at the next natural moment, usually renewal, rather than opening every contract at once.
Juritas checks each ICT contract against Article 30(2) and, where it applies, 30(3), quoting the clause that meets each requirement and drafting the amendment for what’s missing.