NIS2/DORA vendor clauses for your website-maintenance contracts

Free checklist · AuditedWP · v1.0, August 2026 · Not legal advice — have counsel review before use.

Regulated clients (and their auditors and insurers) increasingly treat the company that runs their website as part of their supply chain. Under NIS2, essential and important entities must manage supply-chain security; under DORA Art. 28–30, financial entities must contractually govern ICT third-party providers — and "our website is outsourced" increasingly counts. This checklist lists what a regulated client will demand from its maintenance vendor, so you can answer before being asked.

1. Contract & governance clauses to add

Clause	What it should say
Service description	Explicit list of services: updates, backups, patching, monitoring, incident handling — with scope per site.
Security measures	Vendor commits to defined technical/organisational measures (access control, least privilege, encrypted storage of credentials).
Audit / evidence right	Client may request documentation of performed work (change logs, backup test records) at reasonable notice.
Incident notification	Vendor notifies client of any security incident affecting the site within an agreed window (e.g. 24h) with a named contact.
Subcontracting	Any subcontractor (hosting, tooling) is disclosed and bound by equivalent obligations.
Data location	Data and backups stored within the EU / EEA; jurisdiction specified.
Termination & exit	On termination, full handover: current backups, change history export, credentials returned/deleted.
Liability cap	A realistic cap tied to fees — neither zero nor unlimited.

2. Evidence you must be able to produce

Change log per site: every core/plugin/theme update with before/after versions, timestamp and operator identity.
Backup records: schedule, retention period, and proof of periodic restore tests — not just "backups are taken".
Access inventory: who has admin access to which sites, reviewed periodically.
Patch policy: agreed maximum time from security release to deployment.
DPA: a signed data-processing agreement if personal data is involved (it usually is — contact forms, analytics, webshop orders).

3. Questions your regulated client may ask you in 2026–27

"Where exactly are our backups stored, and under whose jurisdiction?"
"Show me what was changed on our site last quarter, by whom."
"When was the last restore test, and can I see the record?"
"Do you use subcontractors or AI automation? Who is accountable?"
"What happens to our data if we terminate the agreement?"

The gap this exposes: most generic care plans give you uptime and updates, but no revision-ready evidence trail. If you resell wholesale maintenance, your name — not the vendor's — is on the answers above.

About AuditedWP

AuditedWP provides white-label WordPress maintenance for EU web agencies with a revision-ready audit trail built in: every update, backup, patch and restore documented per site, EU hosting and DPA as standard. You keep the client relationship and the margin; we run the operations and hand you the evidence.