For years, third-party risk management (TPRM) has followed a familiar pattern. A supplier is
onboarded, completes a security questionnaire, shares a few certifications, and passes a
risk assessment. The results are documented, filed away, and often not revisited until the
next annual review.
Suppliers continuously change their infrastructure, software, personnel, and security
controls. New vulnerabilities emerge daily, threat actors adapt their techniques, and cyber
incidents can occur without warning. A vendor that appeared secure six months ago may
present a very different risk today.
This shift is also reflected in modern cybersecurity regulations. Organizations are
increasingly expected to manage third-party risk as an ongoing activity-not as a point-intime compliance exercise.
Regulations Are Moving Toward Continuous Risk Management
Several leading cybersecurity regulations now emphasize that risk management must be
continuous, proportionate, and integrated into day-to-day operations.
Under Article 21(2)(d) of Directive (EU) 2022/2555 (NIS2), organizations are required to
implement cybersecurity risk management measures covering:
“Supply chain security, including security-related aspects concerning the
relationships between each entity and its direct suppliers or service providers.”
This requirement goes beyond simply assessing suppliers during onboarding. It expects
organizations to understand and manage supplier-related risks throughout the
relationship lifecycle.
The expectation becomes even clearer in Commission Implementing Regulation (EU)
2024/2690, which introduces detailed technical requirements for essential and important
entities. Among other things, organizations are expected to establish structured processes
for supplier selection, contractual security requirements, ongoing oversight, and supply
chain governance.
Similarly, Digital Operational Resilience Act (DORA) requires financial entities to
continuously monitor ICT third-party providers throughout the duration of the contractual
relationship, rather than relying solely on onboarding due diligence.
Even outside Europe, regulations such as Japan NSC, Singapore MAS TRM, UAE CSC
framework and APRA CPS 230 encourage organizations to regularly review external risks and
maintain ongoing oversight of suppliers that support critical business functions. The
direction is consistent across frameworks: supplier risk is dynamic, and organizations are
expected to manage it accordingly.
Why Annual Vendor Assessments Fall Short
The challenge is simple: assessments represent a snapshot in time, while risk continues to
evolve. Imagine assessing a cloud provider in January. By June, the provider may have
experienced a data breach, changed its hosting architecture, lost an important certification,
acquired another company, or disclosed several critical vulnerabilities. None of these
developments would appear in last January’s assessment.
As a result, organizations relying solely on periodic reviews may be making decisions based
on outdated information. There are four common blind spots:
- Security posture changes. Certifications expire, vulnerabilities emerge, and security controls evolve.
- New cyber incidents. A supplier may become the victim of ransomware or disclose a significant breach after the assessment is completed.
- Business changes. Suppliers may introduce subcontractors, expand services, or significantly change their technology stack.
- Regulatory expectations. Demonstrating ongoing oversight is becoming just as important as demonstrating initial due diligence.
The longer the interval between assessments, the larger the gap between documented risk and actual risk.
Continuous Monitoring Closes the Visibility Gap
Continuous monitoring does not mean sending security questionnaires every week. Instead,
it means maintaining ongoing visibility into changes that could affect supplier risk.
Organizations should monitor indicators such as:
- Publicly disclosed security incidents
- New vulnerabilities affecting supplier infrastructure
- Changes to certifications and compliance status
- Threat intelligence and dark web exposure
- Security ratings and external attack surface
- Significant organizational or operational changes
This allows security and risk teams to focus on meaningful changes rather than repeating the same assessment process on a fixed schedule. Instead of asking, “Was this supplier secure last year?”, organizations can answer a far more valuable question: “Is this supplier still operating within our acceptable level of risk today?”
From Periodic Reviews to Continuous Assurance
Initial due diligence remains essential for understanding a supplier’s security posture before
engagement. However, maintaining trust requires ongoing validation throughout the
supplier lifecycle. This shift enables organizations to:
- Detect emerging risks earlier
- Prioritize reassessments based on real changes rather than calendar dates
- Produce stronger audit evidence
- Reduce manual effort while improving coverage
- Better align with modern regulatory expectations such as NIS2 and DORA
In other words, organizations move from periodic assessment to continuous assurance.
How 3rdComply Supports Continuous Vendor Risk Management
If organizations are finding it difficult to operationalize continuous monitoring using spreadsheets and manual processes, 3rdComply provides a purpose-built TPRM platform designed to simplify the entire supplier risk lifecycle. Rather than replacing existing procurement or GRC platforms, 3rdComply complements them by automating supplier assessments, centralizing evidence, continuously monitoring vendors through public intelligence, security disclosures, news, and dark web sources, and using AI to evaluate supplier responses against an organization’s own policies and standards. For organizations with limited internal resources, managed services are also available to perform assessment and monitoring activities on their behalf. The result is a more scalable, evidence-driven, and continuously monitored TPRM program that aligns with evolving regulatory expectations without significantly increasing operational
effort.
Modern regulations are sending a consistent message: third-party risk management is no longer an annual event-it is an ongoing responsibility.
The organizations that can answer that question with confidence will be better positioned not only for regulatory compliance, but also for building a more resilient and trustworthy supply chain. Emerging risk demand emerging solutions.