DORA turns the contents of every ICT services contract a financial entity signs into a regulatory requirement, and a missing clause is a compliance finding rather than a commercial gap. Article 30 of Regulation (EU) 2022/2554 lists the minimum terms for all ICT contracts and a longer set for services that support critical or important functions, and two Level 2 standards add detail: Delegated Regulation (EU) 2024/1773 on the contractual policy and Delegated Regulation (EU) 2025/532 on subcontracting. This guide turns those texts into a clause-by-clause checklist, shows how to remediate an existing contract book, and covers the identity and access terms that procurement often leaves out. It is for third-party risk, legal, procurement and security teams at EU financial entities, and for ICT providers that serve them. For the wider third-party pillar and the register of information, see the DORA ICT Third-Party Risk and Register of Information Guide; this page covers the contract terms alone.
Key takeaways
- Two tiers of mandatory terms. Article 30(2) sets nine minimum elements for every ICT services contract; Article 30(3) adds six more, including unrestricted audit rights, TLPT participation and exit with a mandatory transition period, where the service supports a critical or important function.
- One written document. Article 30(1) requires rights and obligations to be clearly allocated in writing, with the full contract, including service levels, in one written document available on paper or in a downloadable, durable and accessible format.
- Subcontracting has its own standard. Delegated Regulation 2025/532 lists twelve conditions the contract must contain when the provider may subcontract critical or important services, plus a notice-and-object process for material changes.
- The policy comes before the contract. Delegated Regulation 2024/1773 requires a management-approved contractual policy, reviewed at least once a year, with ex-ante risk assessment, due diligence and limits on relying only on certifications.
- Credentials belong in the contract. Article 30 does not name access keys or service accounts, but its security, incident, audit and exit terms only work if the contract also covers how provider identities are issued, monitored and revoked.
Scope: which contracts Article 30 reaches
Article 30 applies to contractual arrangements on the use of ICT services between financial entities in scope of DORA and ICT third-party service providers. DORA has applied since 17 January 2025, so new contracts must already comply and existing contracts should have been brought into line through renegotiation. Four scope questions decide the work for each contract:
- Is it an ICT service? Article 3(21) defines ICT services broadly as digital and data services provided through ICT systems to internal or external users on an ongoing basis, and the definition also reaches hardware as a service. Cloud, SaaS, managed security, data feeds and software support are typical.
- Does it support a critical or important function? This decides whether Article 30(3) applies. The 2024/1773 policy must include or reference the methodology for that decision and say when it is reviewed.
- Is it intragroup? DORA defines ICT intra-group service providers in Article 3(20), and group providers still need compliant contracts. Article 7 of 2024/1773 requires conflicts of interest, including financial terms, to be handled objectively.
- Is the entity a microenterprise? For the monitoring rights in Article 30(3)(e), a microenterprise and its provider may agree to delegate access, inspection and audit rights to an independent third party appointed by the provider, with the entity able to request information from that party at any time.
Article 30(4) asks both parties to consider standard contractual clauses developed by public authorities for specific services when negotiating. These are optional aids; they do not replace checking each mandatory element.
Article 30(2): terms for every ICT contract
| Point | Required element (paraphrased from Article 30(2)) | What to check in the draft |
|---|---|---|
| (a) | Clear and complete description of all functions and services, stating whether subcontracting of services supporting critical or important functions is permitted and, if so, on what conditions | A service schedule, not a marketing description; an explicit subcontracting position |
| (b) | Locations (regions or countries) where services are provided and data processed, including storage, and advance notice of any planned change | Named regions per service and data type; a notice period you can act on |
| (c) | Provisions on availability, authenticity, integrity and confidentiality of data, including personal data | Security schedule tied to your ICT risk framework; DPA cross-referenced |
| (d) | Access, recovery and return of personal and non-personal data in an easily accessible format on insolvency, resolution, discontinuation or termination | Format, timeline and cost of return; deletion evidence afterwards |
| (e) | Service level descriptions, including updates and revisions | Version control for SLAs; who may change them |
| (f) | Assistance during ICT incidents related to the service, at no additional cost or at a cost determined ex-ante | A priced or free assistance clause, with contact routes and response times |
| (g) | Full cooperation with the competent and resolution authorities, including persons they appoint | No confidentiality term that blocks supervisors |
| (h) | Termination rights and related minimum notice periods, in line with authority expectations | Cross-reference to Article 28(7) termination grounds (below) |
| (i) | Conditions for the provider's participation in the entity's ICT security awareness and digital operational resilience training under Article 13(6) | Who attends, how often, at whose cost |
Article 28(7) supplies the termination grounds that point (h) must support: a significant breach by the provider of law, regulation or contract terms; circumstances found through monitoring that could alter the performance of the contracted functions; evidenced weaknesses in the provider's overall ICT risk management, in particular around the availability, authenticity, integrity and confidentiality of data; and arrangements under which the competent authority can no longer effectively supervise the entity.
Article 30(3): extra terms for critical or important functions
| Point | Required element (paraphrased) | Drafting notes |
|---|---|---|
| (a) | Full service level descriptions with precise quantitative and qualitative performance targets, to allow monitoring and prompt corrective action | Numbers, measurement method and remedy per target; 2024/1773 Article 9 expects remedies, including penalties where appropriate |
| (b) | Notice periods and reporting obligations, including notice of any development that may materially affect the provider's ability to deliver | Include changes of control, key subcontractors and security posture |
| (c) | Requirements to implement and test business contingency plans and to have ICT security measures, tools and policies that give an appropriate level of security in line with the entity's regulatory framework | Test frequency, evidence shared, joint exercises |
| (d) | Obligation to participate and fully cooperate in the entity's TLPT under Articles 26 and 27 | Pooled testing option where the provider serves many entities |
| (e) | Ongoing monitoring rights: unrestricted access, inspection and audit for the entity, an appointee and the competent authority, including taking copies of relevant documents on-site; agreed alternative assurance levels where other clients' rights are affected; full cooperation in on-site inspections and audits by authorities, the Lead Overseer, the entity or its appointee; and details of scope, procedures and frequency | Rights must not be impeded by other contracts or policies; 2024/1773 Article 8 limits reliance on certifications alone |
| (f) | Exit strategies, including a mandatory adequate transition period in which the provider continues to deliver, so the entity can migrate to another provider or bring the service in-house | Transition length, cost, data and knowledge transfer; links to the Article 28(8) exit plan |
Article 28(8) requires the matching exit strategy on the entity's side: exits without business disruption, comprehensive and documented exit plans that are sufficiently tested and periodically reviewed, identified alternatives and transition plans. 2024/1773 Article 10 adds that each contract needs a documented exit plan based on plausible scenarios. See the Cloud Exit Plan Template and the Cloud Concentration Risk and Exit Strategy Guide.
Subcontracting terms under Delegated Regulation 2025/532
Article 30(5) mandated technical standards on the subcontracting element of point 2(a). The result, Delegated Regulation (EU) 2025/532 of 24 March 2025, was published in the Official Journal on 2 July 2025. Before agreeing that a provider may subcontract critical or important services, Article 3 requires the entity to assess conditions including the provider's due diligence on subcontractors, its ability to identify and notify them, equivalent access and audit rights down the chain, location risks and ICT concentration risk under DORA Article 29. Relying on the provider's own assessments does not reduce the entity's responsibility.
Article 4(1) then lists what the contract must specify. Paraphrased:
- Responsibility and monitoring: the provider is responsible for subcontracted services, monitors them, and has monitoring and reporting duties towards the entity.
- Location: the provider assesses location risks for subcontractors, their parent companies and the place the service is provided from; the location of data processed or stored by subcontractors is specified where relevant.
- Flow-down: monitoring and reporting obligations, business contingency plans, service levels, ICT security standards and the same access, inspection and audit rights for the entity and authorities pass down to subcontractors.
- Continuity: service continuity is maintained throughout the chain if a subcontractor fails.
- Change and exit: the provider notifies material subcontracting changes, and the entity can terminate under Article 6 of the Regulation or DORA Article 28(7).
Article 5 sets the change process: the provider informs the entity of intended material changes with enough time to assess them, the contract fixes a reasonable notice period (no number is set), changes are implemented only after approval or after the period ends without objection, and the entity objects before the period ends if the change exceeds its risk tolerance. Article 6 lets the contract provide for termination where the provider implements changes despite an objection, implements them before the notice period ends, or subcontracts a critical or important service the contract does not explicitly permit.
The contractual policy behind the contracts
Delegated Regulation (EU) 2024/1773 sets the policy each entity must have for contracts supporting critical or important functions. Points that change how contracts are negotiated:
- Governance (Article 3): the management body reviews the policy at least once a year; a senior manager is responsible for monitoring the arrangements; critical or important services are independently reviewed and included in the audit plan.
- Before signing (Articles 5 and 6): an ex-ante risk assessment covering operational, legal, ICT, reputational, data, location and concentration risks, and proportionate due diligence on the provider's skills, security standards, subcontractors, location and sanctions exposure, and consent to audits including on-site audits.
- Assurance mix (Articles 6 and 8): own audits, pooled audits, independent reports, certifications and provider internal audit reports, with more than one source where appropriate; over time, certifications and audit reports alone are not enough unless the entity is satisfied with scope, currency and operational effectiveness, and keeps the right to expand scope.
- Changes (Article 8): material changes recorded in a dated, signed written agreement, and the renewal process specified.
- Monitoring (Article 9): performance indicators that include confidentiality, availability, integrity and authenticity, regular provider reports (security and business continuity among them) and documented assessments that feed back into the risk assessment.
Where identity fits: provider credentials in the contract
Most ICT services run on non-human identities that cross the contract boundary: API keys and OAuth clients you issue to the provider, service accounts it holds in your tenant, and keys it issues to you. None of these are named in Article 30, but points 30(2)(c), (f) and 30(3)(c), (e), (f) cannot be met without them. Our recommended schedule, aligned to those points:
- Issuance and least privilege (30(2)(c), 30(3)(c)): the provider uses named, scoped credentials per environment; no shared administrator accounts; MFA or workload identity federation for human and machine access where the service supports it.
- Inventory and reporting (30(3)(b), (e)): the provider maintains and shares on request a list of credentials it holds for your environment and the subcontractors that can use them. Record them in a Third-Party Credential Register Template.
- Incident handling (30(2)(f)): notification of suspected credential compromise within an agreed window and assistance with rotation and log review. See Vendor contract clauses for credential revocation and breach notice.
- Exit (30(2)(d), 30(3)(f)): a revocation and attestation step in the transition plan: every credential either party issued is revoked, and the provider confirms deletion of copies.
How to remediate a contract book
- Start from the register. Use the register of information to list every ICT contract and flag those supporting critical or important functions. Remediate those first.
- Gap-assess against both tables. Score each contract for each 30(2) point and, where relevant, each 30(3) point and the 2025/532 Article 4(1) list: present, partial, missing.
- Prepare an addendum, not a rewrite. A DORA addendum that overrides conflicting terms is faster to agree than a new master agreement. Pilot it with two or three providers of different sizes, including one hyperscale provider with standard terms and one niche provider.
- Use provider addenda carefully. Many large providers publish their own DORA addenda. Map each against your table and record residual gaps and compensating measures (for example, pooled audits under 30(3)(e)(ii)).
- Escalate unresolved gaps. Where a provider will not agree a mandatory element, record it, assess whether Article 28(7) or an exit is needed, and report it through the senior manager named under 2024/1773 Article 3.
- Keep the change auditable. Material changes go into a dated, signed agreement (2024/1773 Article 8); update the register of information at the same time.
Rollback here means retaining the previous signed terms until the addendum is countersigned; never let a contract lapse into an unsigned state while terms are negotiated.
Decision guidance
- Critical or important, or not: our recommendation is that, when unsure, you apply 30(3). The extra cost is mainly audit and exit clauses, and reclassifying later means renegotiating.
- Own audit or pooled audit: for large multi-tenant providers, pooled audits and alternative assurance levels under 30(3)(e)(ii) are realistic; keep the right to audit directly when a specific concern arises.
- Small and large entities: proportionality in 2024/1773 Article 1 lets smaller entities simplify the policy, not drop mandatory clauses. Microenterprises may use the third-party audit delegation in Article 30(3).
- Providers: ICT providers serving many financial entities save effort by publishing one DORA addendum mapped point by point to Article 30 and 2025/532.
Detection and measurement
Our suggested indicators for the third-party risk committee: share of critical or important contracts with all Article 30(3) elements present (target 100%); contracts with at least one missing 30(2) element; subcontracting changes notified versus discovered by other means; exit plans tested in the last 12 months; and provider credentials revoked within the agreed window at contract end.
Framework mapping
| Framework | Reference | Relation to Article 30 |
|---|---|---|
| NIST CSF 2.0 | GV.SC-05; GV.SC-10 | Supply chain requirements in contracts; provisions for activities after the agreement ends |
| NIST SP 800-53 Rev 5 | SA-9 External System Services; SR-8 Notification Agreements; SR-6 Supplier Assessments and Reviews | Provider obligations, notification and assessment rights |
| EBA Guidelines | EBA ICT and security risk guidelines | Earlier outsourcing and ICT expectations; see the EBA ICT and Security Risk Guidelines Guide |
Common failure patterns
- Audit rights limited by the provider's own policies: Article 30(3)(e)(i) says rights must not be impeded or limited by other contractual arrangements or implementation policies.
- Locations listed for primary processing only: 30(2)(b) covers storage too, and 2025/532 adds subcontractor data locations.
- Exit clauses without a transition period: 30(3)(f) requires the provider to keep delivering during an adequate transition period.
- Subcontracting silence: if the contract does not say whether critical or important services may be subcontracted, point 2(a) is not met, and 2025/532 Article 6 termination cannot work.
- Certification-only assurance: 2024/1773 Article 8 does not allow sole reliance on certifications and audit reports over time.
- Credentials outlive the contract: provider keys and service accounts left active after exit defeat the data return and termination terms.
Practitioner checklist
- Classify every ICT contract by critical or important function using the documented methodology.
- Gap-assess each contract against all nine Article 30(2) points.
- Add the six Article 30(3) points for critical or important services, including TLPT cooperation and a transition period.
- Add the twelve 2025/532 Article 4(1) conditions wherever subcontracting is permitted, with a notice-and-object process.
- Put the full contract and service levels in one written, downloadable document.
- Review the contractual policy at management body level at least once a year.
- Include a credential schedule: issuance, inventory, compromise notice and revocation at exit.
- Test exit plans and record results in the register of information.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
- EUR-Lex: Commission Delegated Regulation (EU) 2024/1773 on the policy for contractual arrangements
- EUR-Lex: Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions
- NIST: Cybersecurity Framework (CSF) 2.0
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
This guide summarises Article 30 of DORA and its related delegated regulations and is not legal advice. Related NHI Mgmt Group resources: DORA Guide · DORA ICT Third-Party Risk and Register of Information Guide · Third-Party Security Contract Clauses Template · DORA Critical ICT Third-Party Provider Oversight Guide