NIS2 and your WordPress site: are you in scope?

NIS2 does not regulate websites; it regulates organizations. Your WordPress site matters under NIS2 in two situations: your company is in scope and the site is one of its information systems, or you build, host or maintain WordPress sites for a company that is in scope. This guide covers the scope check, the categories that matter for WordPress businesses, and the measures and deadlines that follow.

The rules come from Directive (EU) 2022/2555, but nobody applies the directive directly. Each Member State writes its own NIS2 law, so the final answer always depends on your country's national law and authority.

Is your company in NIS2 scope? A three-step check

Step 1: Is your sector listed in Annex I or Annex II?

NIS2 lists sectors in two annexes. Annex I covers sectors of high criticality, such as energy, transport, banking, health, drinking water, digital infrastructure, ICT service management (business-to-business), public administration and space. Annex II covers other critical sectors, such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

If none of these describes what your company does, NIS2 generally does not apply to you directly. Check the annexes themselves: each sector is broken down into specific types of entity.

Step 2: Are you medium-sized or larger?

NIS2 uses a size cap: in general, only medium-sized and large entities are covered. You count as at least medium-sized if you have 50 or more employees, or more than €10 million in both annual turnover and balance sheet total. Small and micro companies are generally out of direct scope.

Broadly, large entities in Annex I sectors become "essential entities", while medium-sized Annex I entities and entities in Annex II sectors become "important entities". There are exceptions, for example for DNS and qualified trust service providers. The label matters for supervision and for the maximum fines.

Step 3: Does a size-independent exception apply?

Some entities are covered whatever their size. Examples are DNS service providers, top-level domain name registries, trust service providers and providers of public electronic communications networks or services. Check the exact list in your national law.

Where WordPress businesses fit into NIS2

For most companies, the website is not the reason they are in scope. A manufacturer with 300 employees is covered because of its sector and size; its WordPress site, intranet and online shop then belong to the systems its NIS2 risk management has to consider.

Two Annex I categories matter directly for the WordPress world:

• Digital infrastructure, which includes cloud computing service providers, data centre service providers and content delivery networks. A WordPress hosting company or managed WordPress platform of medium size or larger can fall here.
• ICT service management (business-to-business), which covers managed service providers (MSPs) and managed security service providers. Roughly, an MSP installs, manages, operates or maintains ICT products, networks, infrastructure or applications for customers, on site or remotely.

The second category is the one many agencies overlook. A medium-sized web agency that hosts client sites, runs their updates and backups, and holds admin access to their systems can be a managed service provider in NIS2 terms. A small agency or a freelancer is usually not directly in scope because of the size cap, but is very likely a supplier to someone who is.

Cloud, CDN and managed service providers generally fall under the Member State of their main establishment in the EU, even if they serve several countries. That is the national law to read first.

Only a supplier? What NIS2 customers will ask you

Article 21(2)(d) requires entities in scope to manage supply chain security, including the security aspects of their relationships with direct suppliers and service providers. In practice, this is how NIS2 reaches small agencies, freelancers, hosting resellers and plugin vendors: through security questionnaires, contract clauses and audits from customers who are in scope.

Typical requests:

• How you patch WordPress core, plugins and themes, and how fast.
• Who has admin access to the customer's sites, and whether multi-factor authentication is enforced.
• How often you back up, where backups are stored, and when you last tested a restore.
• How quickly you will inform the customer about a security incident, so they can meet their own 24-hour deadline.
• Evidence: scan reports, update logs, an incident log, a named security contact.

The easiest way to answer these questions is to keep that evidence anyway. Our WordPress security checklist groups the usual measures so you can turn them into a written routine.

NIS2 Article 21 measures that touch a WordPress site

Article 21(2) lists ten minimum measures, (a) to (j). Not all of them are about websites, but several translate directly into WordPress practice:

Two of these deserve priority on almost any WordPress site. First, patching: most WordPress vulnerabilities sit in plugins, and our guide to vulnerable WordPress plugins explains how to inventory, update and replace them. Second, multi-factor authentication: WordPress core has no built-in two-factor login, so you need a plugin or an identity provider. See two-factor authentication for WordPress admins.

NIS2 names the areas, not the tools. How far you go in each area depends on your risk analysis, and your national law or authority may add more detailed requirements.

Management duties and the 24-hour reporting clock

Under Article 20, the management body must approve the cybersecurity risk-management measures, oversee their implementation and follow training. Managers can be held liable for infringements. For an agency or host in scope, security is a management topic, not a side job for the most technical employee.

Article 23 sets the reporting timeline for significant incidents. Roughly, an incident is significant if it causes or can cause severe operational disruption or financial loss, or considerable damage to others. Reports go to your national CSIRT or competent authority:

1. Early warning within 24 hours of becoming aware of the incident.
2. Incident notification within 72 hours, with an initial assessment.
3. Final report within one month after the incident notification.

A hacked WordPress site can also be a personal data breach under the GDPR, with its own 72-hour deadline towards the data protection authority. The two duties run in parallel, to different authorities. Our article on the GDPR 72-hour breach notification covers that side.

NIS2 fines and transposition status

Article 34 requires Member States to allow fines for infringements of Articles 21 and 23 with these minimum maximums:

• Essential entities: at least up to €10 million or 2 % of worldwide annual turnover, whichever is higher.
• Important entities: at least up to €7 million or 1.4 % of worldwide annual turnover, whichever is higher.

National laws set the actual amounts and procedures.

The transposition has been slow. The directive was adopted on 14 December 2022, and Member States had until 17 October 2024 to transpose it. The European Commission sent letters of formal notice to 23 Member States on 28 November 2024 and reasoned opinions to 19 Member States on 7 May 2025. On 9 July 2026, it referred Ireland, Spain, France and the Netherlands to the Court of Justice. The Commission's NIS2 page is a good place to follow developments.

In practice, deadlines, registration duties and fines depend on where you are established and on your national law. Check that law and your authority's guidance before relying on any EU-level summary, including this one.

FAQ

Does NIS2 apply to my small business website?

Generally not directly. Small and micro companies are usually out of scope unless a size-independent exception applies, for example for DNS or trust services. If you supply customers who are in scope, expect contractual security requirements.

Is a WordPress web agency a managed service provider under NIS2?

It can be, if it is medium-sized or larger and manages clients' systems, for example hosting, updates, backups and admin access. A studio that only designs and hands over sites is a different case. Check the definition in your national law.

This article is general information, not legal advice.