NIS2 Compliance for Small Web Agencies

Chapter 1: Does NIS2 Apply to Your Agency?

This is the first question, and it's the one most agencies get wrong. Many assume they are too small to be in scope. Under NIS2, that assumption can be costly.

The Scope Test

NIS2 applies to medium-sized and large enterprises in covered sectors. The size thresholds are:

• Large enterprise: 250+ employees OR €50M+ annual turnover AND €43M+ balance sheet
• Medium enterprise: 50–249 employees OR €10M–€50M turnover
• Small enterprise: Below 50 employees AND below €10M turnover

Good news: If your agency has fewer than 50 employees and less than €10M annual turnover, you are a "small enterprise" and generally NOT directly in scope for NIS2.

Bad news: You still need to read this guide. Here's why.

Why Small Agencies Must Still Comply

1. Your clients are in scope. If you serve medium or large enterprises that ARE subject to NIS2, they must assess their supply chain — and that includes you. Your security posture becomes their problem.

2. Contractual requirements. Enterprise clients are already adding NIS2 clauses to their vendor contracts. If you cannot demonstrate basic compliance, you lose the contract.

3. Downstream liability. Under NIS2 Article 21(2)(c) on supply chain security, your clients are required to assess the security practices of their suppliers. If you are the weak link, they will be penalized for it — and they will not hesitate to pass that liability to you.

4. Competitive disadvantage. Agencies that can demonstrate NIS2 alignment win more pitches. It is becoming a differentiator.

Quick Self-Assessment

Answer these three questions:

1. Do any of your clients have more than 50 employees? → If yes, they are likely in NIS2 scope.

2. Do you handle any of the following for clients: hosting, server management, DNS, email infrastructure, SSL/certificate management, backup services, or security monitoring? → If yes, you are a digital service provider in their supply chain.

3. Do you have access to your clients' networks, data, or administrative systems? → If yes, you are a vector they must secure.

If you answered yes to any of the above, you need to be NIS2-ready — even if the directive does not name you directly.

Important vs. Essential Entities

NIS2 divides in-scope entities into two categories:

As a small agency, you will likely never be an Essential or Important entity. But your clients will be — and they will require you to meet equivalent security standards.

Verdict: Read this guide, implement the measures, and document everything. You will not face direct NIS2 fines, but you will face client contract losses if you are not prepared.

Chapter 2: The 10 Essential Security Measures (Article 21)

Article 21 of NIS2 requires in-scope entities to implement "appropriate and proportionate technical, operational, and organisational measures." The directive lists 10 categories. Below, I translate each into practical actions for a small agency.

2.1 Risk Analysis and Security Policies

What NIS2 says: Entities must perform risk analyses and establish security policies.

What to do:

• Write a one-page Information Security Policy covering: acceptable use, password requirements, device security, remote work rules.
• Review it annually (set a calendar reminder).
• Store it in a shared location all employees can access.

Template: A sample Information Security Policy is included in the appendices.

2.2 Incident Handling

What NIS2 says: Entities must have processes for detecting, handling, and reporting incidents.

What to do:

• Designate one person as Security Contact (can be you or a team member).
• Create a simple Incident Response Plan in 6 steps: Detect → Triage → Contain → Eradicate → Recover → Review.
• Use a free monitoring tool (e.g., UptimeRobot, Better Stack) to detect outages.
• For WordPress agencies: install a security plugin (e.g., Wordfence, iThemes Security) and enable real-time monitoring.

2.3 Business Continuity and Backup Management

What NIS2 says: Entities must ensure business continuity, including backup management and disaster recovery.

What to do:

• Implement the 3-2-1 backup rule: 3 copies, 2 different media, 1 offsite.
• For client sites: use automated backup (UpdraftPlus, BlogVault, or server-level snapshots).
• Test restoration quarterly — a backup that cannot be restored is worthless.
• Document your backup procedure in one page.

2.4 Supply Chain Security

What NIS2 says: Entities must assess and manage security risks in their supply chain.

What to do:

• List every third-party service you use: hosting providers, DNS, email, plugins, payment processors.
• For each, document: what data they handle, their security certifications (SOC 2, ISO 27001), and their data processing location.
• Require your own subcontractors to meet equivalent security standards.

2.5 Security in System Acquisition and Maintenance

What NIS2 says: Security must be part of how you acquire, develop, and maintain systems.

What to do:

• Keep all systems updated: WordPress core, plugins, themes, server software.
• Remove unused plugins and themes — they are attack surface.
• Use a maintenance schedule: weekly updates for security patches, monthly full review.

2.6 Vulnerability Handling and Disclosure

What NIS2 says: Entities must have processes for handling vulnerabilities.

What to do:

• Subscribe to security advisories for all major software you use.
• For WordPress: use WPScan or a security plugin to detect known vulnerabilities.
• Establish a disclosure channel: create a [email protected] email address.

2.7 Testing and Auditing

What NIS2 says: Entities must test and audit their security measures regularly.

What to do:

• Run an automated security scan quarterly (e.g., HackerTarget, Detectify, or WPScan).
• Review access logs monthly for suspicious activity.
• Document all tests and their results.

2.8 Use of Cryptography and Encryption

What NIS2 says: Entities must use appropriate cryptography and encryption.

What to do:

• Ensure HTTPS everywhere (LetsEncrypt is free — use it on all client sites).
• Encrypt all backups (at rest and in transit).
• Use a password manager (Bitwarden, 1Password) — never share passwords in email.
• Enable MFA on all administrative accounts.

2.9 Human Resources Security

What NIS2 says: Entities must ensure personnel understand and follow security practices.

What to do:

• New employee onboarding: 30-minute security briefing covering: password hygiene, phishing awareness, data handling, incident reporting.
• Annual refresher (send a 5-minute guide, no need for formal training).
• Include confidentiality clauses in employment contracts (or independent contractor agreements).

2.10 Access Control

What NIS2 says: Entities must control access to systems and data.

What to do:

• Implement least privilege: every user gets only the access they need to do their job.
• Use role-based access: separate admin access from day-to-day accounts.
• Review access quarterly — remove accounts for former employees or contractors immediately.
• For WordPress: use a user role editor plugin to create granular permissions.