DORA Article 28 ICT third-party risk: WordPress hosting and WAF supplier audit

#DORA Article 28 ICT third-party risk: WordPress hosting and WAF supplier audit

Article 28 of Regulation 2022/2554 is the part of DORA that decides whether a financial-entity client can sign a hosting contract or a WAF subscription at all. It applies to credit institutions, payment institutions, insurers, investment firms, crypto-asset service providers and around fifteen more categories listed in Article 2. From 17 January 2025 it applies directly without national transposition.

This is a supporting article in the NIS2 and DORA on WordPress pillar, with cross-references to the NIS2 Annex II evidence trail and the CRA + NIS2 + DORA stack overview.

#TL;DR

• DORA Article 28 = general principles for managing ICT third-party risk.
• Article 30 = the mandatory contractual clauses.
• Article 31 = the CTPP designation regime, run by the European Supervisory Authorities.
• A WordPress engagement with a bank or insurer triggers a register entry, due diligence, mandatory clauses and an exit strategy.
• Hosting, CDN, WAF, payment gateway plugin and email-sending plugin all enter the register.

#Which financial entities DORA applies to

Article 2(1) of DORA enumerates the financial entities. The most common in WordPress engagements:

• Credit institutions and their groups.
• Payment institutions and electronic money institutions.
• Investment firms, including those running an MTF or OTF.
• Crypto-asset service providers under MiCA.
• Insurance and reinsurance undertakings.
• Insurance and reinsurance intermediaries above the size threshold.
• Crowdfunding service providers.
• Investment funds (UCITS managers, AIFMs).

Plus the critical ICT third-party service providers (CTPP), designated under Article 31 by the European Supervisory Authorities (EBA, EIOPA and ESMA) through the Joint Committee, on a recommendation from the Oversight Forum. The first list was published on 18 November 2025 and names 19 providers: public clouds (Amazon Web Services, Google Cloud, Microsoft, Oracle), IT consultancies and outsourcers (Accenture, Capgemini, IBM, Kyndryl, NTT DATA, Tata Consultancy Services), telecom and data-centre operators (Colt, Deutsche Telekom, Equinix, InterXion, Orange), financial data vendors (Bloomberg, LSEG Data and Risk) and software vendors (FIS, SAP). No WordPress host and no CDN is on it. A WordPress agency is an ordinary ICT third-party service provider, and the obligations of Articles 28 to 30 reach it through the contract with the financial entity.

#DORA Article 28 requirements paragraph by paragraph

Article 28 has ten paragraphs. The first eight bind the financial entity; paragraphs 9 and 10 instruct the European Supervisory Authorities to draft technical standards. What each one means for a WordPress engagement:

Article 28(1). The financial entity manages ICT third-party risk as an integral component of ICT risk within its ICT risk-management framework. Point (a) is the sentence procurement quotes most: the entity remains fully responsible for compliance at all times, even after outsourcing the service. Point (b) adds proportionality, based on the nature, scale, complexity and importance of the ICT dependencies. The supplier provides evidence; the responsibility does not move.

Article 28(2). A strategy on ICT third-party risk, reviewed regularly, which includes a policy on the use of ICT services supporting critical or important functions. The management body regularly reviews the risks of those arrangements. Microenterprises and entities under the simplified regime of Article 16(1) are outside this paragraph.

Article 28(3). A register of information on all contractual arrangements for ICT services, distinguishing those that support critical or important functions. The entity reports at least yearly to the competent authority on the number of new arrangements, the categories of providers and the services provided, makes the full register available on request, and informs the authority in a timely manner about any planned arrangement for a critical or important function. For WordPress: hosting, CDN, WAF, payment gateway, transactional email, AI provider, monitoring tool, backup destination.

Article 28(4). Before signing, the entity assesses whether the arrangement supports a critical or important function (point a), whether supervisory conditions for contracting are met (point b), all relevant risks, including the ICT concentration risk of Article 29 (point c), performs due diligence on the suitability of the provider (point d) and assesses conflicts of interest (point e).

Article 28(5). Contracts only with providers that comply with appropriate information security standards. For critical or important functions, the entity takes due account of the most up-to-date and highest quality standards. An ISO/IEC 27001 or SOC 2 report from the host counts as evidence only if its scope covers the contracted service.

Article 28(6). The entity pre-determines, on a risk-based approach, the frequency and the areas of audits and inspections of the provider, and verifies that the auditors have the skills to assess technically complex services.

Article 28(7). The contract must be terminable for a significant breach by the provider, for circumstances that could alter the performance of the functions (including material changes in the provider’s situation), for evidenced weaknesses in the provider’s ICT risk management, or where the competent authority can no longer effectively supervise the entity because of the arrangement.

Article 28(8). Exit strategies for ICT services supporting critical or important functions. The exit must not disrupt business activities, limit regulatory compliance or harm the continuity and quality of services to clients. Exit plans must cover the whole service, be documented, sufficiently tested and reviewed periodically.

Article 28(9) and (10). Mandates for technical standards. Paragraph 9 produced Commission Implementing Regulation (EU) 2024/2956 with the register templates. Paragraph 10 produced Commission Delegated Regulation (EU) 2024/1773 on the content of the policy in paragraph 2.

#What DORA Article 30 clauses belong in WordPress hosting contracts

Article 30(1) requires the full contract, including the service level agreements, to be documented in one written document. Article 30(2) lists the minimum elements of any ICT contract; Article 30(3) adds the elements for contracts supporting critical or important functions. The agency template I ship with hosting and WAF contracts follows the same numbering:

Article 30(4) adds that the parties should consider standard contractual clauses developed by public authorities. I keep this matrix as a single Markdown file in the engagement folder. Every contract is checked against it before signature.

#DORA register of information for WordPress suppliers

A WordPress engagement for a financial entity touches more ICT third-parties than the procurement team usually anticipates. The register I produce on day one of an engagement:

• Hosting provider. The actual data-centre operator, the management plane, the support team. Critical-or-important if the WordPress site is part of customer-facing service delivery.
• CDN provider. Cloudflare, Fastly, Akamai. Treats traffic, can see request bodies, terminates TLS. Often classified as critical-or-important.
• WAF provider. Sometimes the same entity as the CDN, sometimes separate (Sucuri, Imperva). Inspects payloads. Critical-or-important.
• Payment gateway plugin. Stripe, Adyen, mollie, regional gateways. The plugin author is one supplier; the gateway operator is another. Both go into the register.
• Transactional email provider. SES, Postmark, SendGrid. Carries password resets, KYC notifications, AML alerts. Often critical-or-important.
• Monitoring and APM. New Relic, Datadog, Sentry. Receives stack traces and partial request payloads.
• Backup destination. S3, Backblaze, Wasabi. Holds the database and the uploads. Recovery depends on it, so it usually supports a critical or important function.
• AI provider. If the WordPress site uses an LLM for any customer-touching function (chat, summarisation), the LLM provider is in scope.
• Plugin marketplace. WordPress.org, premium marketplaces. Update channels are part of the supply chain in the sense of the “ICT service supply chain” defined in Article 1(2) of Implementing Regulation 2024/2956.

For each provider the register holds: legal name, contract reference, services description, data flows, criticality classification, location of processing, last due-diligence date, exit strategy reference.

#DORA register of information templates under Implementing Regulation 2024/2956

The register is not a free format. Implementing Regulation (EU) 2024/2956 sets the standard templates the entity uses to maintain the register of Article 28(3). Three of its rules change what a WordPress agency has to hand over:

• Provider identifier. Article 3(5) requires each provider that is a legal person to be identified by a valid and active legal entity identifier (LEI) or by the European Unique Identifier (EUID), and by both where available. For an EU company the EUID comes from the business register; the LEI is applied for separately. Individuals acting in a business capacity are exempt.
• Rank in the supply chain. Article 2 assigns every provider a rank: the direct provider is always rank 1 and each subcontractor gets a higher number. If the agency invoices a third party’s hosting, the agency is rank 1 and the host is rank 2.
• Subcontractors behind critical or important functions. Article 3(2)(b) requires the register to include all subcontractors that effectively underpin those services, and Article 3(6) requires them to provide an LEI or EUID as well, through the direct provider.

Article 5 lists the templates, among them B_05.01 (direct providers and subcontractors), B_05.02 (ICT service supply chain), B_06.01 (identification of functions) and B_07.01 (assessment of services supporting critical or important functions). With that structure, the sheet I hand to the client holds, per provider, the legal name, LEI or EUID, rank, service, locations of service and processing, and the function it supports.

#How to assess DORA concentration risk with one cloud provider

Concentration risk has its own article. Article 28(4)(c) points to Article 29, which requires the entity to check, for services supporting critical or important functions, whether a new contract ties it to a provider that is not easily substitutable, or adds to multiple arrangements with the same provider or with closely connected providers. A bank that uses Cloudflare for CDN, Cloudflare Workers for backend, Cloudflare R2 for object storage and Cloudflare Stream for video falls into the second case. This is not a Cloudflare-specific finding; the same applies to AWS, Azure or GCP stacks.

In WordPress it usually looks like this: hosting on AWS, backups to S3, email through SES, monitoring with CloudWatch. Four AWS dependencies, one provider. Article 29(1) asks the entity to weigh the benefits and costs of alternatives, such as using different providers; it does not require diversification at any price. The risk register must acknowledge the concentration explicitly and either justify it or plan diversification. Article 29(2) adds, for subcontractors established in a third country, the applicable insolvency law, constraints on urgent recovery of data and compliance with Union data protection rules.

#What is a DORA exit strategy for WordPress hosting and WAF

Article 28(8) requires the exit strategy to be documented and tested. For WordPress hosting and WAF a real exit strategy includes:

• Database export in standard format. SQL dump compatible with stock MySQL or MariaDB, no proprietary extensions.
• Filesystem export including uploads. Tar or zip archive, downloadable from outside the provider’s console.
• DNS control. Domain registrar account owned by the financial entity, not the agency, not the host.
• Plugin and theme licence portability. Licences in the entity’s name, transferable to a new host.
• Tested transition. A staging environment on an alternative host that can be promoted in a documented timeframe. The test is logged and dated.
• Contractual transition window. Article 30(3)(f) requires a mandatory transition period during which the provider keeps delivering the service while the entity migrates. The hosting contract sets its length and price.
• Return of data. Article 30(2)(d) requires that the entity can access, recover and receive its data in an easily accessible format if the provider becomes insolvent, discontinues its business or the contract ends.

Pricing for engagements that include the exit-strategy package is individual; the exit document itself adds days, not hours, and it is a deliverable.

#How DORA changes WordPress agency procurement

A WordPress agency that arrives with the Article 30 clause matrix already populated, the supplier register template ready, and a proven exit strategy passes procurement faster. The financial entity does not have to translate Article 28 into a contract; it pastes the agency’s deliverables into its own ICT risk-management framework.

This is also the reason why a regulated client filters supplier shortlists by jurisdiction. An EU-based agency operating under EU contract law removes a layer of friction; an agency outside the EU makes the entity weigh what Article 29(2) requires for a third country: the applicable insolvency law, urgent recovery of data and compliance with Union data protection rules.

#How to classify critical or important functions under DORA

Article 3(22) of DORA defines a critical or important function as one whose disruption would materially impair the entity’s financial performance or the soundness or continuity of its services and activities, or whose failure would materially impair compliance with the conditions of its authorisation or its other obligations under financial services law. Procurement cannot classify a provider from its brand name or annual spend. Start with the function the arrangement supports and the effect of its disruption, degradation or compromise. A brochure site hosted by a bank may be important to communications without supporting a critical financial service. A small plugin that controls customer authentication or payment status may have a much higher operational impact than its contract value suggests.

The assessment record should identify the business service, process owner, affected customers, data handled, recovery objectives, tolerated manual workarounds and dependencies on other providers. It should also state who approved the critical-or-important-function decision and when it will be revisited. This classification drives the depth of due diligence and the additional Article 30 terms. It is not a reusable label that the supplier can award itself. Article 3(2) of Delegated Regulation 2024/1773 requires the entity’s policy to set the methodology for deciding which ICT services support critical or important functions and when that assessment is reviewed.

#ICT supplier due diligence checklist for WordPress

Ask for evidence tied to the proposed service rather than a generic security brochure. For a WordPress host, CDN, WAF or managed-service agency, the review pack normally includes:

• legal entity, ownership group, service locations and named subcontractors;
• architecture and data-flow boundaries, including administrative access and support paths;
• access-control, MFA, privileged-access review and personnel offboarding evidence;
• vulnerability, patch and change-management procedures with recent operating samples;
• incident-notification route, escalation contacts and evidence-preservation capability;
• backup, restoration and continuity test results relevant to the contracted service;
• independent assurance reports, their scope, exclusions and remediation status;
• proposed service levels, recovery objectives, audit support and termination assistance.

A certificate can support the review, but it does not answer whether the certified boundary includes the WordPress management plane, support team or backup destination. Record evidence date, period covered, reviewer and unresolved questions. Where the provider cannot disclose sensitive material, agree a controlled review, independent report or specific contractual assurance instead of silently marking the item complete.

#DORA subcontracting rules for WordPress providers

The direct supplier rarely operates the whole stack. A managed WordPress agency may use a cloud platform, CDN, ticketing system, monitoring service and offshore support provider. The contract and register need enough detail to distinguish the contracting party from the entities that actually store data, administer systems or support a critical or important function.

Define which subcontracting changes require notice, what information the notice contains, the objection or termination path and how existing data will be handled. Procurement should also identify fourth-party concentration: two apparently independent suppliers can rely on the same hyperscaler, identity platform or DNS operator. A list that is never updated after signature is not an effective control.

Commission Delegated Regulation (EU) 2025/532, which develops Article 30(2)(a), sets out these conditions. Under its Article 3 the entity decides before signing whether the provider may subcontract a service supporting a critical or important function, and signs only if the provider can assess its subcontractors and identify all of them. Article 4 requires the contract to state which services may be subcontracted and that the provider stays responsible for, and monitors, the services its subcontractors deliver. Article 5 covers material changes: the provider announces them well in time, the contract sets a reasonable notice period to approve or object, and the change is not implemented before the entity approves it or lets the period pass without objecting.

#How to test a DORA exit plan

Concentration is not solved merely by having two logos in the architecture. If the secondary host uses the same cloud region, the backup account shares the same identity provider, or DNS remains under the outgoing supplier’s control, the alternative may fail with the primary service. Map common ownership, infrastructure, geography, administrative credentials and specialist knowledge.

An exit test should prove that authorised staff can obtain current data and configuration, validate integrity, rebuild the service, switch traffic, preserve required records and revoke the old supplier’s access. Measure the elapsed time and compare it with the approved business tolerance. Document any manual steps, licence constraints, data-format problems and functions that cannot be reproduced. The result can be an accepted residual risk, a remediation plan or a sourcing change. Article 28 does not imply that every dependency must be diversified regardless of cost.

#DORA supplier review frequency and approval criteria

Set the review cadence according to criticality and change. Article 28(6) requires the frequency and areas of audits to be set in advance, and Article 3(1) of Delegated Regulation (EU) 2024/1773 requires the management body to review the policy on ICT services supporting critical or important functions at least once a year. Also trigger a supplier reassessment after a material incident, acquisition, new processing location, important subcontractor change, significant service redesign or deterioration against agreed levels. The service owner, procurement, security, legal and data-protection functions need defined roles; sending an annual questionnaire without evaluating the answers is not sufficient governance.

Before approval, require a named control owner, completed evidence log, resolved contractual gaps or formally accepted exceptions, a register entry, an actionable exit plan and a date for the next review. Acceptance should distinguish facts verified by evidence, supplier assertions, matters outside scope and residual risks. A supplier audit reduces uncertainty; it does not certify the financial entity’s DORA compliance or guarantee uninterrupted service.

For a scoped review, send a written brief with the financial function, proposed supplier and service, architecture, data classes, subcontractors already known, recovery objectives, contract status and procurement deadline. The NIS2 and DORA readiness service can then structure the supplier inventory, evidence gaps, contract checklist, concentration analysis and retest plan for the WordPress surface.

#Related reading on compliance

• Pillar: NIS2 and DORA on WordPress: 2026 compliance stack
• NIS2 Annex II for WordPress agencies: scope, deadlines, evidence trail
• WordPress incident response under NIS2: 24-hour early warning playbook
• Cyber Resilience Act + NIS2 + DORA: the 2026 compliance stack for headless WordPress