Platform audit: 5 checks before you commit to a CMS

A structured evaluation is the difference between picking a content management system that fits this quarter and picking one that holds for five years. Most CMS regret traces back to a thin evaluation. The product itself is rarely what failed. The fix is a structured evaluation across five dimensions: strategic fit, talent and cost, integration and exit, security and compliance, and vendor and ecosystem risk.

This is the same framework we use when clients ask us to evaluate a shortlist.

Why most CMS evaluations fail

Vendor demos run on curated content, ideal data shapes, and a presenter who knows where the rough edges are. Every element is staged for the platform to look its best, and the staging holds for the length of the demo. Production looks different: messier content, integration debt, edge cases the demo never had to handle, and a team that does not have the vendor's product manager on call.

Feature comparison spreadsheets share the same flaw. Every modern CMS can plausibly check the same fifty boxes. The questions that actually decide the next five years, what does it cost to staff over time, what happens when you want to leave, what is the platform's actual security operating record, do not fit in a binary column.

The third common failure mode is the time pressure of an executive decision cycle. A platform pick gets framed as a one-week sprint that leads to a board meeting and a signature. The evaluation period is set by the project timeline, not by the cost of the decision. Most CMS commitments outlast their decision-makers. The people running the platform in year four did not vote.

This framework is a different shape of evaluation, deliberately slower than a feature comparison and structured around the dimensions where the cost of getting it wrong is measured in years. Five of those dimensions matter more than any other. Each is named below, with the specific signals to look for and the trap most teams fall into when evaluating it.

The shape of the question changes once you stop asking what the CMS does and start asking what it costs to live with. The same five-year decision looks like this:

The five checks

A CMS evaluation framework rests on five selection criteria that decide whether a platform will hold for five years or for five quarters. They run in this order: strategic fit, talent depth and operating cost, integration and exit surface, security and compliance posture, and vendor and ecosystem risk. Each check has a clear question to answer, a short list of signals to evaluate, and the traps most teams fall into when evaluating it. The order is decisive: a poor strategic fit caps the upside on every other dimension, while a strong outcome on talent and cost still leaves you exposed if the vendor risk is high.

1. Strategic fit

This check examines whether the CMS aligns with the company's long-term vision, not just its current situation. A platform decision that fits today's use but cannot hold the planned roadmap creates a second migration before the first one is amortized.

The signals to evaluate:

• Fit for the primary use case. Corporate marketing, content publishing, e-commerce, multi-brand portfolio, internal portal, headless front for a mobile app. Each has a different ideal architecture. Platforms that excel at one rarely excel at all five.
• Content-model flexibility. Can you express your editorial structures cleanly, or will the team be working around the platform within six months?
• Scaling envelope. Traffic ceilings, content-volume ceilings, multi-site or multi-region coverage, multilingual depth.
• Composability stance. Monolithic core, opinionated platform with a composition layer, or fully decoupled and assembled. The right mode depends on your team and your roadmap.
• Editorial experience. How fast and clean it is for non-technical editors to find, create, preview, and publish content. A platform that engineers love and editors fight surfaces in editorial velocity within six months.
• AI and agentic readiness. How the platform exposes content to large language models and agentic workflows. For a 2026 commitment, this shapes how editors and developers will work with the platform over the next three to five years.

Strategic fit can mean picking a monolith that does everything, or picking an opinionated core plus the right composition layer. The evaluation needs to surface which mode each candidate is built for, and whether your team is sized for the operational discipline that mode requires.

The trap: evaluating this check against today's requirements and discovering in year two that the platform cannot hold the roadmap. Roadmaps drift, acquisitions happen, and new regions get added. The right question is not whether the CMS can do what you need this quarter. It is whether the headroom is there for the changes you can reasonably anticipate over the next thirty-six months.

2. Talent depth and operating cost

This check asks whether you can actually staff this stack over a three-to-five-year horizon, and what it really costs to run. License fees are the sticker price. The real cost lives in the people who build and operate the platform.

The signals to evaluate:

• Developer market depth. Run a sample search for the platform's required skill set on Stack Overflow, LinkedIn, and the regional hiring boards your company actually uses. Count candidates, day rates, and average time-to-hire. The result tells you what hiring will cost in year two when your incumbents move on.
• Hosting and operating cost envelope. Reserve capacity, scaling tier, managed-service markup, observability tooling, and the engineering hours spent maintaining all of it.
• Licensing model and price trajectory. Per-seat, per-environment, per-traffic-tier, or open-source with paid support. Each shifts cost differently as you grow.
• True three-year cost of ownership. License plus hosting plus development plus operations plus the cost of carrying technical debt that the platform's choices push onto your team.

The talent-market asymmetry between platforms is visible in published surveys. Stack Overflow's 2025 developer survey, with more than 49,000 respondents across 177 countries, found WordPress used by 12.4 percent of professional developers and Drupal by 2.1 percent. W3Techs' fingerprinting of the top 10 million sites puts WordPress at 59.5 percent CMS share and Drupal at 1.0 percent. These numbers map directly to year-two recruitment depth.

The last item is where most evaluations underestimate. That cost stays out of the licensing comparison and surfaces in year two, when the team realizes the platform's opinionated choices have to be worked around for every non-standard feature.

The trap: comparing license cost only and ignoring the development, operations, and hiring market that determines actual cost-to-operate. The cheapest license is rarely the cheapest platform.

3. Integration and exit surface

This check asks two questions in sequence. How cleanly does the CMS plug into the systems you already use? And what does it cost to leave? The first decides your launch effort, the second your regret cost.

The signals to evaluate:

• API surface in. Native integrations for the CRM, identity provider, e-commerce engine, analytics stack, and marketing automation you already run. Native beats certified-partner, certified-partner beats community-maintained, community-maintained beats build-it-yourself.
• API surface out. REST, GraphQL, or both. Webhook depth. Headless readiness if you might decouple the front end later.
• Content portability. Can content be exported in a format another platform can import? Are file formats open or proprietary? Does the export include relationships, taxonomies, and revisions, or only flat fields?
• Database and asset portability. If you need to leave, can you take the database structure and the media files with you, or are they trapped behind vendor tooling?
• Contractual exit terms. Notice period, data return obligation, transition assistance, and the cost of the run-off period.

Most evaluations cover the integration story well and ignore the exit story entirely. This is rational at the moment of decision and expensive five years later. Platforms compete to make integration easy because that is when prospects are watching. Exit costs are not part of the sales conversation. They only become visible when the cost of staying exceeds the cost of leaving.

The trap: evaluating the integrate-in story without evaluating the extract-out story. The platform that wires up to your CRM in a weekend may also be the platform that locks your content into a proprietary format you cannot export without rewriting it.

4. Security and compliance posture

This check asks what the platform's actual security operating record looks like, and whether it meets the regulatory surface your organization sits inside. The evidence to weigh is published advisory history. A clean marketing page does not count.

The signals to evaluate:

• Public advisory track record. How often does the platform disclose security issues? How fast are patches released after disclosure? Is there a coordinated advisory process, or do fixes appear silently in release notes?
• Core versus ecosystem ratio. A platform with thousands of third-party plugins behaves differently from a platform with a small core and a curated extension model. Both can be safe. Both need to be assessed differently.
• Encryption and data residency. Encryption at rest and in transit defaults, regional hosting options, support for customer-managed keys where regulation requires it.
• Compliance fit. The regulatory surface you operate under: GDPR for any EU traffic, accessibility standards (WCAG 2.2), and sector-specific obligations like HIPAA or PCI DSS. Reference frameworks like the OWASP Top 10 to structure the security part of the audit.

The Patchstack 2026 whitepaper disclosed 11,334 new vulnerabilities in the WordPress ecosystem in 2025, roughly 31 per day, with 91 percent in plugins, 9 percent in themes, and only 6 in the core itself. The 2025 figure is a 42 percent year-over-year increase, and 46 percent of vulnerabilities lacked a vendor fix at the time of public disclosure. That distribution is a property of the ecosystem model rather than a critique of it, and it tells you what the evaluation needs to weigh. A platform with most of its risk in third-party extensions needs a different operational discipline from one with most risk in the core itself. The same applies to any CMS with a large module market.

This is where the connection to a steady maintenance and support cadence becomes load-bearing. The evaluation measures the cadence the vendor is capable of, while the contract measures the cadence your team will actually maintain.

The trap: treating "is it secure" as a binary question. A platform with a clean advisory history is a stronger signal than a platform that claims no vulnerabilities. Transparent disclosure is a maturity signal, not a weakness.

5. Vendor and ecosystem risk

This check asks what happens to the platform if the vendor pivots, gets acquired, or shrinks. Even a strong product can become a liability if the entity behind it changes.

The signals to evaluate:

• Governance model. Foundation-led open-source, single-vendor-controlled, or community-governed. Each carries different continuity risk. A foundation with named board members and a published charter is harder to capture than a single-vendor open-source play.
• Vendor business signals. Funding stage, profitability, customer concentration, employee count trend. Public filings if available, press coverage if not.
• Ecosystem depth. Module or plugin marketplace size, certified integrator network, training and certification programs, conference and community activity.
• Community velocity. Commit cadence on the public repository, release cadence, time-to-merge for community contributions.
• Specific lock-in vectors. Proprietary file formats, opinionated domain-specific languages, vendor-locked hosting, mandatory marketplace dependencies.

The economic backdrop has shifted measurably. BCG reported in 2025 that software grew from 13 percent to 21 percent of enterprise tech budgets over the previous five years. That trajectory turns vendor risk from a governance question into a budget question.

The working assumption here is that the vendor will, at some point, do something you did not plan for. The platform you commit to needs to be resilient to that scenario.

The trap: discounting governance risk because the platform is in growth mode and looks unstoppable today. The platforms that looked unstoppable five years ago are not all still around in their original form.

Where this fits in your decision

This framework is the discipline that converts an open-ended decision into a defensible one. The five checks give your team a shared vocabulary for the trade-offs, a record of what was evaluated, and a baseline to revisit in eighteen months when the platform is up and the surprises start to surface.

Most teams figure out exit cost the year before they need to migrate, when staying first costs more than leaving. The framework's job is to make that number visible while you can still walk away. Our team runs audit and advisory engagements exactly along these lines. If the evaluation has converged on Drupal or WordPress, we can also step in for the implementation work. Either way, the right time to talk is before you sign, not after. Get in touch if you want to walk a shortlist through the framework together.

Frequently asked questions

What is a platform audit, and how is it different from a CMS selection checklist?

A platform audit is a structured evaluation of a content management system against the five dimensions that decide its multi-year fit: strategic alignment, talent and cost, integration surface, security posture, and vendor risk. It is the discipline that converts a feature-list comparison into a defensible commitment. A CMS selection checklist tells you whether a platform can do the things on your list today. A platform audit tells you what it will cost to live with that platform for the next three to five years.

When should I audit a CMS, before committing or after we have inherited a platform?

Both moments warrant an audit, but the highest-leverage moment is before commitment. Pre-commit, the cost of changing direction is the cost of evaluating one more candidate. Post-commit, the cost of changing direction is a migration project. A post-inheritance evaluation is still valuable when you take ownership of a platform that someone else picked, because it tells you what you actually have versus what was sold to the previous decision-makers.

How long does a CMS audit take?

In our practice, a focused audit on a shortlist of three to five candidates runs two to four weeks. The variability comes from how much access the vendors give you to documentation, reference customers, and trial environments. The fastest audits are the ones where the evaluator has done the same work before and knows where to push and what to ignore.

Should our internal team run the audit, or do we need an outside partner?

Internal teams can run the audit if they have a senior technical lead with experience across more than one of the candidate platforms, and the discipline to slow the decision down against executive pressure. The most common reason teams bring in an outside partner is not lack of skill but lack of independence: an internal team that has run the current platform for years has accumulated views that bias the audit. An outside partner brings cross-platform experience and the structural distance to evaluate honestly.

How is this framework different from a typical "how to choose a CMS" guide?

A typical how-to-choose-a-CMS guide is a feature comparison: a list of capabilities, a few questions to ask vendors, and a recommendation to run a proof of concept. The framework here is an audit: it evaluates a CMS on what it will cost to live with for the next three to five years, not on what it can do today. The two cover different ground. A feature guide is useful when your decision is about which platform launches your next project fastest. An audit is useful when your decision is about which platform you can afford to commit to for the next five years.

Keroberos is a web technology consultancy that advises businesses on platform selection, commissions and delivers WordPress and Drupal builds, and provides staff augmentation for development teams. To discuss your platform decision before you commit, contact us.