Vendorapp › OpenVMO › Contracts
Contracts in OpenVMO.
Contracts are where vendor risk becomes enforceable. Store them against the vendor, know when each one renews, and make sure the vendors that matter have signed up to security, privacy, incident and exit terms.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
An unnoticed auto-renewal is the most common and most avoidable vendor cost. A missing breach-notification clause is the most expensive contract gap. Both are cheap to prevent once contracts sit in the register.
Contracts is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 5 CON practices.
Contracts stored
Contracts and order forms are stored against the vendor in the register. Evidence: A contract link for every vendor with a contract.
Renewals tracked
Renewal and notice dates are tracked, with an alert at least one notice period before each deadline. Evidence: Renewal and notice dates in the register, and the reminders that fired.
Security clause set
Tier 1 and 2 contracts include the OpenVMO clause set: data processing agreement, breach notification window, assurance or audit rights, subprocessor change notice, data return and deletion at exit, and termination assistance. Evidence: The clause checklist completed for each Tier 1 and 2 contract.
Deviations recorded
Where a contract does not meet the clause set, the gap is recorded as an accepted risk. Evidence: Risk log entries referencing the contract and the missing clause.
Regulated flow-down
Where you sell to regulated customers, their required terms (for example DORA Article 30 or NIS2 supplier requirements) flow down to the vendors that support them. Evidence: Contracts or addenda containing the flowed-down terms, mapped to the customer requirement.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | Every contract stored against its vendor, with renewal and notice dates and reminders. |
| Level 2: Managed | Tier 1 and 2 contracts checked against the clause set, gaps recorded as accepted risks. |
| Level 3: Defined | Regulated customers’ terms flowed down to the vendors that support those customers. |
| Level 4: Optimised | Standard clause libraries and negotiation playbooks, with contract data used in spend and risk reporting. |
With a spreadsheet
Doing it without any special tool.
- Add renewal date and notice period columns, and a formula for the last day to give notice.
- Put each notice deadline in a shared calendar with the owner invited.
- Run the OpenVMO contract clause checklist on each Tier 1 and 2 contract and save the result next to it.
Common mistakes
Where teams usually go wrong.
- Tracking the renewal date but not the notice period, so the reminder arrives too late.
- Signing the vendor’s DPA without reading its breach notification window.
- Assuming click-through terms cannot be negotiated. For Tier 1 vendors they often can.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2, CC2.3 |
| ISO/IEC 27001:2022 | A.5.20, A.5.23 |
| NIS2 and Implementing Regulation 2024/2690 | CIR 2024/2690 Annex §5.1 |
| DORA | Art. 30 |
| NIST CSF 2.0 | GV.SC-05 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Contract clause checklist (Markdown): The clause set for Tier 1 and 2 contracts, with a column for what the contract actually says.
- Vendor register (CSV): The register with every OpenVMO minimum field as a column, plus two example rows. Open it in any spreadsheet.
All OpenVMO templates are on the templates page.
Previous domain: Due diligence. Next domain: Ongoing monitoring.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.