Service pillar
NIS2 and DORA readiness
Premium B2B compliance, EU jurisdiction, scoped per project.
Pricing is individual. I reply within one working day.
- NIS2 Directive 2022/2555, in force
- DORA applied since 17 January 2025
- 24h / 72h / 1m NIS2 incident reporting
- Article 28 DORA third-party register
What I ship
A written readiness report. A populated supplier register that follows the DORA Article 28 fields or the NIS2 Annex II evidence-trail structure. A control gap assessment mapped to the directive's required controls. An incident reporting runbook with the 24-hour, 72-hour, and one-month timelines pre-mapped to your specific stack. A 60-minute walkthrough for your operational team.
Why WordPress estates need this differently
Most readiness work targets bespoke software or SaaS. WordPress and WooCommerce introduce specific compliance surfaces: plugins with administrator-level capabilities, themes that touch the database, payment gateways that fan out to third parties, and an editorial layer that often runs outside formal change-management. Treating those as first-class objects in the supplier register is the difference between a defensible report and a checkbox exercise.
Who this is for
- Medium and large entities in NIS2 essential and important sectors (Annex I, Annex II)
- Regulated financial entities subject to DORA
- Critical ICT third-party providers serving DORA-scoped customers
- Public-sector procurement that requires a third-party readiness statement before a WordPress procurement closes
Certification vs operational reality
ISO, GDPR, and NIS2 paperwork does not guarantee that a department can actually send an encrypted email. Classic field case: a public-sector or mid-market entity has the auditor, the policies, and the certificate, but its older Ricoh and Nashuatec multi-function printers cannot negotiate TLS with the mail server and silently fail scan-to-email. The scanned PDF ends up on a USB stick, breaking the chain of custody and leaving no log of who handled the file. That class of device rarely has an exception in the ISO statement of applicability, the GDPR records of processing, or the KSC register. Our audit therefore covers both documents and what actually happens at the desk, and maps every such device into the asset and supplier lists.
Polish transposition note (relevant for clients with PL operations)
Poland's NIS2 transposition launches the Krajowy System Cyberbezpieczeństwa (KSC) register via a government online application from 7 May 2026, with a 3 October 2026 self-registration deadline. Public bodies, telcos, and digital service providers are auto-enrolled on 6 May. Sanctions reach 100 million PLN; executive liability up to 3x monthly salary, and the April 2026 amendment extends that personal accountability beyond board members to the broader executive layer overseeing in-scope areas. Source: Polish trade-press reporting via Ministerstwo Cyfryzacji, May 2026. International groups with Polish entities should expect their PL subsidiaries to land in this scope; we cover that in the supplier register and evidence trail.
Engagement model
Senior B2B contracts on EU jurisdiction. Four-week window from kickoff to report. Quarterly review retainer available. Pricing is individual.
Frequently asked questions
Does NIS2 apply to my WordPress site?
It applies to medium and large entities in essential and important sectors as defined in Annex I and Annex II. If you are a digital service provider, online marketplace, healthcare provider, public administration, or critical infrastructure supplier above the size threshold, you are in scope. The directive is national law in every member state by now; the supervisory authority is country-specific.
What about DORA?
DORA applies to regulated financial entities and to their critical ICT third-party providers, in force since 17 January 2025. If your WordPress estate carries customer-facing financial services or you operate as an ICT supplier to one, Article 28 requires a register of information and contractual provisions on subcontracting, exit strategy, and incident reporting.
What is the deliverable?
A written readiness report, a populated supplier register that follows the DORA Article 28 fields or the NIS2 Annex II structure, a control gap assessment with remediation effort estimates, and an incident reporting runbook with the 24-hour, 72-hour, and one-month timelines pre-mapped to your stack.
Can you also remediate the gaps?
Yes, as a separate engagement. The readiness report stays decoupled from implementation so it remains defensible. If you ask me to remediate, the implementation is scoped from the gap list; pricing is individual. Remediation typically combines hardening work from the security audit pillar with supplier-contract changes that your legal team owns.
How does this work for WordPress as opposed to bespoke software?
Most NIS2 and DORA readiness firms understand bespoke software and SaaS. WordPress and WooCommerce introduce specific failure modes: plugins with admin-level capabilities, themes with database access, payment gateways that fan out to third parties, and an editorial layer that often goes outside change-management. I treat those as first-class compliance surfaces, not afterthoughts.
Explore other WordPress services and knowledge base
Strengthen your business with professional technical support in key areas of the WordPress ecosystem.
NIS2 and DORA scope mapping, supplier register, incident runbook.
Audit, hardening, and incident risk reduction.
WCAG 2.2, BFSG, EAA conformance report and remediation backlog.
Stability, updates, and post-launch support.
Custom WordPress engineering and architecture.
Headless WordPress, Sanity, Strapi, and Contentful with Astro or Next.js.
Supporting articles
CRA covers products with digital elements. NIS2 covers entities. DORA covers financial entities. When all three apply at once, headless WordPress sits at the intersection. I sketch what the joint evidence package looks like in 2026.
The NIS2 Directive (2022/2555) was to be transposed into national law by 2024-10-17. The DORA Regulation (2022/2554) applies directly from 2025-01-17. For a WordPress site operator this means specific obligations if the site relates to a regulated entity. We explain it without panic, with references to the texts of the acts.
Article 21 of Directive 2022/2555 lists ten risk-management measures every in-scope entity must implement. I map each one to a WordPress agency control, with the evidence file each one requires for audit.
Cluster reading
Scope and stack
- NIS2 and DORA on WordPress: 2026 compliance
- CRA + NIS2 + DORA: 2026 compliance stack for headless WordPress
- NIS2 vs DORA: scope overlap for WordPress agencies
Evidence and operational artefacts
- NIS2 Annex II evidence trail
- DORA Article 28: ICT third-party risk
- DORA register of information: WordPress supplier fields
Incident response
Adjacent services
Make the auditor's job boring
Tell me the entity classification (NIS2 sector or DORA scope) and the WordPress estate in scope. I reply within one working day.
Contact me