NIS2/DORA vendor clauses for your website-maintenance contracts
Regulated clients (and their auditors and insurers) increasingly treat the company that runs their website as part of their supply chain. Under NIS2, essential and important entities must manage supply-chain security; under DORA Art. 28–30, financial entities must contractually govern ICT third-party providers — and "our website is outsourced" increasingly counts. This checklist lists what a regulated client will demand from its maintenance vendor, so you can answer before being asked.
1. Contract & governance clauses to add
| Clause | What it should say |
|---|---|
| Service description | Explicit list of services: updates, backups, patching, monitoring, incident handling — with scope per site. |
| Security measures | Vendor commits to defined technical/organisational measures (access control, least privilege, encrypted storage of credentials). |
| Audit / evidence right | Client may request documentation of performed work (change logs, backup test records) at reasonable notice. |
| Incident notification | Vendor notifies client of any security incident affecting the site within an agreed window (e.g. 24h) with a named contact. |
| Subcontracting | Any subcontractor (hosting, tooling) is disclosed and bound by equivalent obligations. |
| Data location | Data and backups stored within the EU / EEA; jurisdiction specified. |
| Termination & exit | On termination, full handover: current backups, change history export, credentials returned/deleted. |
| Liability cap | A realistic cap tied to fees — neither zero nor unlimited. |
2. Evidence you must be able to produce
- Change log per site: every core/plugin/theme update with before/after versions, timestamp and operator identity.
- Backup records: schedule, retention period, and proof of periodic restore tests — not just "backups are taken".
- Access inventory: who has admin access to which sites, reviewed periodically.
- Patch policy: agreed maximum time from security release to deployment.
- DPA: a signed data-processing agreement if personal data is involved (it usually is — contact forms, analytics, webshop orders).
3. Questions your regulated client may ask you in 2026–27
- "Where exactly are our backups stored, and under whose jurisdiction?"
- "Show me what was changed on our site last quarter, by whom."
- "When was the last restore test, and can I see the record?"
- "Do you use subcontractors or AI automation? Who is accountable?"
- "What happens to our data if we terminate the agreement?"
About EUComply
EUComply provides white-label WordPress maintenance for EU web agencies with a revision-ready audit trail built in: every update, backup, patch and restore documented per site, EU hosting and DPA as standard. You keep the client relationship and the margin; we run the operations and hand you the evidence.
Need the documents themselves today? Our ready-to-use compliance document templates (DPA, NDA clauses, NIS2 vendor terms) start at $29.