Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Singapore Government ICT&SS Policy Reform

Third Party Management

Controls on Third Party Management

Last updated on 10 November 2026

TP-4: Contracts to Govern Third-Party Scope and Responsibilities

Group: Third Party Management

Control Statement

Establish contracts or equivalent instruments with third parties to define and govern the scope, responsibilities, security requirements, and compliance obligations for vendor-assigned work.

Control Recommendations

Agencies should utilise Standard ICT Contract Templates with contract clauses covering: scope of work and service levels; data handling procedures across environments; monitoring SOPs and audit rights; incident reporting and breach protocols; governance and compliance requirements; subcontractor management with approval and disclosure obligations; and business continuity planning including joint emergency exercises for critical systems.

Agencies should consider engaging offshore resources through a local Third Party selected from GovTech’s bulk tender. If Agencies are not able to engage offshore resources through a local Third Party selected from GovTech’s bulk tender, Agencies should ensure that the relevant offshore development contractual provisions from the ICT Contract Template for Offshore Development are incorporated in the contract. On award of the contract or equivalent instrument, Agencies can consider to include the following into their exit management plans:

(a) Obligations of the Third Party during the transition period, including transfer of knowledge, deliverables, or services to another Third Party or to the Agency; (b) Option for the Agency to buy back equipment and software from the Third Party based on a formula for price determination; (c) Transfer of relevant sub-contractor contracts and leases (e.g., maintenance and licensing contracts) to another Third Party or to the Agency (d) Transfer of data, data structures and methodologies to another Third Party or to the Agency; (e) Transfer or critical Third Party staff to another Third Party or to the Agency; (f) Destruction of data by the Third Party; (g) Retrieval of any assets that are provided to the Third Party; and (h) Any other agency-specific requirements to be adhered to by the Third Party.

Risk Statement

Establishing contracts or equivalent instruments using standardised templates ensures consistent vendor obligations, clear accountability, and robust legal frameworks, thereby strengthening project success and security posture.