Contract or Policy?
Use a contract when you need a commitment neither side can change unilaterally (caps, indemnities, service levels); use a policy when you need the freedom to change the rules as your business evolves (security practices, support hours, acceptable use).