The DORA contract clauses, Article 30: nine or fifteen, a status for each

Answer the question and the clauses are listed here.

Every clause, in the Regulation's words

9 clauses in any ICT service contract, 6 more where the service supports a critical or important function, and 12 subcontracting terms where the contract permits subcontracting. The tool above decides which apply to you; this is all of them.

In every contract: 9 clauses

Article 30(2). These are carried by any contract for ICT services, whatever the service supports.

• 30(2)(a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting; ISO 27001: Clause 4.3, A.5.19, A.5.20, A.5.21
• 30(2)(b) the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations; ISO 27001: A.5.9, A.8.9, A.8.32
• 30(2)(c) provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data; ISO 27001: Clause 6.1, Clause 8.2, A.8.13, A.8.24
• 30(2)(d) provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements; ISO 27001: A.5.30, A.8.10, A.8.13
• 30(2)(e) service level descriptions, including updates and revisions thereof; ISO 27001: A.5.30, A.8.6, A.8.16
• 30(2)(f) the obligation of the ICT third-party service provider to provide assistance to the financial entity at no additional cost, or at a cost that is determined ex-ante, when an ICT incident that is related to the ICT service provided to the financial entity occurs; ISO 27001: A.5.24, A.5.26, A.5.28
• 30(2)(g) the obligation of the ICT third-party service provider to fully cooperate with the competent authorities and the resolution authorities of the financial entity, including persons appointed by them; ISO 27001: pure contract, no record
• 30(2)(h) termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities; ISO 27001: pure contract, no record
• 30(2)(i) the conditions for the participation of ICT third-party service providers in the financial entities’ ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6). ISO 27001: Clause 7.3, A.6.3

Where the service supports a critical or important function: 6 more

Article 30(3). The customer decides whether the function is critical or important under Article 28(4)(a); the vendor prepares for the answer being yes.

• 30(3)(a) full service level descriptions, including updates and revisions thereof with precise quantitative and qualitative performance targets within the agreed service levels to allow effective monitoring by the financial entity of ICT services and enable appropriate corrective actions to be taken, without undue delay, when agreed service levels are not met; ISO 27001: A.5.30, A.8.6, A.8.16
• 30(3)(b) notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions in line with agreed service levels; ISO 27001: A.8.32, A.5.20
• 30(3)(c) requirements for the ICT third-party service provider to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security for the provision of services by the financial entity in line with its regulatory framework; ISO 27001: A.5.29, A.5.30, A.8.14
• 30(3)(d) the obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27; ISO 27001: A.8.8, A.8.29
• 30(3)(e) the right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, which entails the following: (i) unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority, and the right to take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies; (ii) the right to agree on alternative assurance levels if other clients’ rights are affected; (iii) the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by the competent authorities, the Lead Overseer, financial entity or an appointed third party; and (iv) the obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits; ISO 27001: Clause 9.2, Clause 9.3, A.5.35
• 30(3)(f) exit strategies, in particular the establishment of a mandatory adequate transition period: (i) during which the ICT third-party service provider will continue providing the respective functions, or ICT services, with a view to reducing the risk of disruption at the financial entity or to ensure its effective resolution and restructuring; (ii) allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided. ISO 27001: A.5.30, A.8.10

Where subcontracting is permitted: 12 terms

Article 4(1) of Delegated Regulation (EU) 2025/532, carried where the contract permits the service, or material parts of it, to be subcontracted.

• RTS 4(1)(a) that the ICT third-party service provider is responsible for the provision of the services provided by the subcontractors; ISO 27001: A.5.19, A.5.21
• RTS 4(1)(b) that the ICT third-party service provider is required to monitor all subcontracted ICT services that support critical or important functions or material parts thereof to ensure that its contractual obligations with the financial entity are continuously met; ISO 27001: A.5.22
• RTS 4(1)(c) the monitoring and reporting obligations of the ICT third-party service provider towards the financial entity regarding subcontractors that provide ICT services that support critical or important functions or material parts thereof; ISO 27001: A.5.22
• RTS 4(1)(d) that the ICT third-party service provider is to assess all risks associated with the location of the current or potential subcontractors that provide ICT service that support critical or important functions or material parts thereof, and their parent company and with the location where the ICT service concerned is provided from; ISO 27001: Clause 6.1, A.5.21
• RTS 4(1)(e) the location of data processed or stored by the subcontractor, where relevant; ISO 27001: A.5.9, A.5.21
• RTS 4(1)(f) that the ICT third-party service provider is to specify in its contract with its subcontractors the monitoring and reporting obligations of that subcontractor towards the ICT third-party service provider, and where agreed, towards the financial entity; ISO 27001: A.5.20
• RTS 4(1)(g) that the ICT third-party service provider is to ensure the continuity of the ICT services that support critical or important functions throughout the chain of subcontractors in case of failure by an ICT subcontractor to meet its contractual obligations; ISO 27001: A.5.29, A.5.30
• RTS 4(1)(h) that the contractual arrangement between the ICT third-party service provider and its subcontractors contains the requirements on business contingency plans referred to in Article 30(3), point (c), of Regulation (EU) 2022/2554 and specifies the service levels to be met by the ICT subcontractors in relation to those plans; ISO 27001: A.5.20, A.5.30
• RTS 4(1)(i) that the contractual arrangement between the ICT third-party service provider and its subcontractors specifies the ICT security standards and any additional security requirements referred to in Article 30(3), point (c), of Regulation (EU) 2022/2554; ISO 27001: A.5.20, Clause 6.1.3
• RTS 4(1)(j) that the subcontractor is to grant to the financial entity and relevant competent and resolution authorities the same rights of access, inspection, and audit as those referred to in Article 30(3), point (e), of Regulation (EU) 2022/2554; ISO 27001: A.5.20, A.5.35
• RTS 4(1)(k) that the ICT third-party service provider is to notify the financial entity of any material change to subcontracting arrangements; ISO 27001: A.8.32, A.5.22
• RTS 4(1)(l) that the financial entity has the right to terminate the contract with the ICT third-party service provider when the conditions laid down in either Article 6 of this Regulation or the conditions laid down in Article 28(7) of Regulation (EU) 2022/2554 have been fulfilled. ISO 27001: pure contract, no record

DORA for a software vendor: the clauses, the register, the actsThe ISO 27001 controls, one page each