The contract is not the only enforceable control to stipulate third party service provider obligations for DR/BCP, nor are both programs necessarily triggered by the pandemic. According to the Shared Assessments Program, third party risk management (TPRM) is a continuous process that requires ongoing monitoring and assessment of third parties' performance, compliance, and resilience. Therefore, the contract should be complemented by other controls, such as due diligence, audits, reviews, and reporting, to ensure that third parties meet the organization's expectations and standards for DR/BCP. Moreover, DR/BCP are not only relevant for pandemic scenarios, but also for other types of disasters, such as natural disasters, cyberattacks, power outages, or human errors. Therefore, the contract should reflect the organization's risk appetite and tolerance for different types of disruptions and scenarios, and not be limited to pandemic-related events.