NIS2 Art.28.1: Database of Domain Name Registration Data (WHOIS)

Audit all domain names registered by your organisation. Make sure the registration data is accurate, complete, and current: registrant name and organisation, administrative contacts, technical contacts, and billing contacts. Put a domain governance process in place. You need a central inventory of every domain name the organisation owns or manages, regular accuracy reviews (at least annually), procedures for updating data when organisational details change, and clear ownership of who manages domains. Check how your registrar implements the NIS2 WHOIS requirements. Verify they are compliant with Art.28 and maintaining your data properly. If your organisation might receive domain registration data access requests, establish procedures for evaluating and responding to legitimate requests, ensure GDPR compliance when processing personal data in registrations, and loop in your legal team on disclosure decisions. Protect your domain registrations from unauthorised changes. Enable domain lock features, use registry lock where available, and deploy DNSSEC. A compromised domain registration is a serious attack vector that can undermine everything else you have built. Work domain name security into your broader cybersecurity risk management. Domain hijacking, typosquatting, and registration data manipulation are real threats that deserve assessment and mitigation alongside your other risks.