Masa CMS

United States · www.masacms.com · 6 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 6 sub-vendors.

Insights

Last updated 2026-08-01 · revision 2

6 direct vendors, 132 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Masa CMS demonstrates medium migration readiness, primarily due to a significant dichotomy in its technology stack. On one hand, modern practices like Docker for containerization, a headless CMS architecture, and REST API support provide a strong foundation for potential migration to cloud-native environments. The company's experience with AWS through its Masa Cloud PaaS offering and the multi-cloud deployment options for its open-source product (AWS, GCP, Azure) indicate familiarity with diverse infrastructure. GDPR compliance also suggests a structured approach to data handling, which can streamline regulatory aspects of migration. However, the most substantial challenge to migration readiness is the core reliance on ColdFusion (CFML). This legacy technology often presents considerable hurdles for re-platforming or re-architecting applications to modern, scalable, and cost-efficient cloud-native stacks, potentially requiring a complete rewrite. While 'Vendor Lock-in Risk' is unknown, the ColdFusion ecosystem itself can create a form of technological lock-in. Furthermore, the absence of data regarding financial stability to fund a potentially complex migration and unspecified data residency requirements introduce uncertainties that could impact the scope and feasibility of future migration efforts.

Compliance

6 in-scope frameworks identified; showing 3.

BIO — Assessment Required

The BIO is the mandatory information security framework for Dutch government organizations and their suppliers. We Are North's client list includes Tweede Kamer der Staten-Generaal (Dutch Parliament), Nederlandse Spoorwegen (NS), Gemeente Leeuwarden, and KOOP (government publishing). Suppliers to Dutch government entities are typically required to demonstrate BIO compliance. Risk is Medium because non-compliance could result in loss of government contracts, which appear to be a significant part of the business.

Evidence: https://www.wearenorth.eu/, https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/cybersecurity/bio-en-ensia/

ISO 27001 (source) — Assessment Required

ISO 27001 is an internationally recognized information security management standard. For a company providing CMS software and cloud services to government entities and enterprises, ISO 27001 certification is increasingly expected. The Dutch government procurement framework and NIS2 compliance both reference ISO 27001-aligned controls. No certification has been found. Risk is Medium because: (1) government clients (Tweede Kamer, NS) typically require ISO 27001 from IT suppliers; (2) absence of certification may limit enterprise sales; (3) non-certification is not a legal violation but represents a significant market and security governance gap.

Evidence: https://www.masacms.com/, https://www.wearenorth.eu/

NIS2 (source) — Assessment Required

Masa CMS is operated by We Are North Groep BV, an EU-based IT services and software development company. The NIS2 Directive (EU 2022/2555) includes 'digital providers' and 'ICT service management' as covered sectors. As a CMS platform provider serving government entities (Tweede Kamer der Staten-Generaal, Nederlandse Spoorwegen) and other organizations, Masa CMS could fall under the 'digital providers' category (specifically managed service providers or online marketplace/platform providers). However, the size threshold (50+ employees or €10M+ turnover) is uncertain — We Are North appears to be a small company. Risk is Medium because: (1) the sector overlap with digital infrastructure is plausible; (2) serving critical public sector clients increases scrutiny; (3) non-compliance with NIS2 carries significant penalties (up to €10M or 2% of global turnover for Important Entities). A formal NIS2 scoping assessment is required.

Evidence: https://www.wearenorth.eu/, https://www.masacms.com/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

Financials

Three-year financials

Financial Resilience Score: 4/10

Masa CMS is an open-source software product, not a legal entity, and therefore has no independent financial profile. The commercial steward, We Are North Groep BV (KVK 70361746), is a small privately-held Dutch IT consultancy based in Rotterdam with a secondary office in Zaventem, Belgium. No public financial statements are available beyond the condensed balance sheet that small Dutch BVs are required to file with the KVK, meaning revenue, EBIT, and equity cannot be independently verified without a paid credit report. Qualitatively, the sponsor benefits from a blue-chip and public-sector client base including Nederlandse Spoorwegen, the Dutch Parliament, KOOP, the European Union, NATO, Adobe, and Visma, which tends to produce sticky recurring revenue. Niche positioning around GDPR-compliant analytics, accessibility (EU Accessibility Act 2025), and composable engineering aligns well with EU regulatory demand, and partnerships with Acquia, AWS, BoxLang, Lucee, and Piwik PRO diversify go-to-market channels. However, the company appears to be a boutique consultancy of roughly 20–50 FTEs with significant key-person risk (Managing Partner Vincent de Winter is the sole publicly named leader), and its technology base (CFML/Lucee/BoxLang, a Mura CMS fork) rests on a shrinking developer ecosystem. Dependence on lumpy public-sector procurement cycles and competition from far larger DXP vendors (Adobe AEM, Sitecore, Optimizely, Contentful, Acquia, WordPress VIP) further constrain the resilience score. The absence of disclosed financials caps confidence in any assessment.

Key strengths: Blue-chip and public-sector client base (Dutch Railways, Dutch Parliament, KOOP, EU, NATO, Adobe, Visma), Niche positioning aligned with EU regulatory demand (GDPR, EU Accessibility Act 2025), Strategic partnerships with Acquia, AWS, BoxLang, Lucee, Piwik PRO, Leadinfo, Multi-country EU footprint (Netherlands + Belgium), Open-source Masa CMS as a lead-generation and credibility engine, Senior-skewed developer team

Risk factors: Very small boutique consultancy with limited financial cushion (estimated <30–50 staff), High key-person risk (single publicly named leader), Legacy technology base on CFML with a shrinking developer ecosystem, No publicly disclosed financials — limited transparency for stakeholders, Lumpy revenue tied to public-sector procurement cycles, Intense competition from far larger CMS/DXP vendors (Adobe, Sitecore, Optimizely, Contentful, Acquia, WordPress VIP), Masa CMS itself is not a legal entity and generates no direct revenue

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report