The State Commissioner for Data Protection and Freedom of Information (LfDI) for Baden-Württemberg has published a model of a commissioned processing agreement within the meaning of Art. 28 DSGVO:
The LfDI has already published sample agreements between jointly responsible parties (see here [EN] and here [EN]).