YTYK You think you know

Card 13 of 15 Third-party risk — the register and the overseer ●●○ Working knowledge

Clauses the contract has to contain

Article 30 sets out mandatory contractual provisions for every ICT service contract — description of services and locations of data processing, service level descriptions, assistance at no additional cost when an incident occurs, cooperation with authorities, termination rights, and access, inspection and audit rights — with an enhanced set where the service supports a critical or important function.

Why it is like this

Resilience obligations that stop at the firm's boundary are worth very little when the function runs on someone else's platform. Mandating the clauses pushes the duties down the chain by contract, because supervision alone could not reach there.

Not to be confused with

Best-practice contract guidance. These are required terms, which means legacy contracts signed before DORA have to be renegotiated — and a provider that refuses is a finding, not a fact of life.

In practice

For critical or important functions the enhanced set adds exit strategies, full service level descriptions with precise quantitative targets, incident notification obligations and unrestricted audit rights.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 30. Read on .

Predict Check yourself

A SaaS provider supporting a critical function refuses to grant audit rights, citing its standard terms. What is the DORA position?

  1. Audit and inspection rights are mandatory for critical or important functions — the firm must obtain them or stop using the provider for that function.
  2. Standard terms prevail where the provider serves many customers.
  3. A pooled audit report from the provider satisfies the requirement in all cases.
  4. The requirement applies only to providers designated as critical by the ESAs.
Show the answer

Audit and inspection rights are mandatory for critical or important functions — the firm must obtain them or stop using the provider for that function.

This is the clause that has caused the most renegotiation in the market. Pooled audits are permitted as a way of exercising the right, not as a way of not having it.