A contract associated with a cloud service provider MUST include:

a business recovery plan 

ownership of responsibilities 

provision for source code escrow 

the provider’s financial statements