The baseline every ICT contract needs
Across all arrangements the contract should describe the services clearly, state where data is processed and stored, set availability and service levels, cover assistance during incidents, and define termination rights and notice.
- Clear description of functions and services provided
- Locations of service provision and data processing
- Data protection, availability, integrity and confidentiality provisions
- Incident assistance and notification obligations
- Termination rights and notice periods
Additional provisions for critical or important functions
Where the service supports a critical or important function, you additionally need full service level descriptions with quantitative targets, unrestricted audit and access rights, obligations to cooperate with competent authorities, subcontracting conditions for the parts of the service that matter, and documented exit strategies with transition support.
Reviewing a legacy portfolio
Do not review alphabetically. Rank contracts by the criticality of the function they support and by renewal date, then work down. For each contract, record the clause areas that are covered, partially covered or missing, with the clause reference, so the gap register is evidence rather than opinion.
Assisted first-pass review is useful here: extracting candidate clauses per area turns a two-hour manual read into a fifteen-minute confirmation. The decision stays with the reviewer, but the search does not have to be manual.