How Often Should Vendors Be Reassessed? A Tier-Based Cadence and the Triggers That Override It
CyberRank Research
Vendors should be reassessed on a cadence set by their risk tier, typically critical vendors quarterly, high-risk vendors twice a year and others annually, with an immediate review after a breach, a rating drop or a material change. Continuous monitoring fills the gaps between those reviews. CyberRank reassesses monitored vendors every night and raises an event when something changes, so triggers do not wait for the next scheduled review.
TL;DR
- Set the cadence by tier: many programmes review critical vendors quarterly, high-risk vendors semi-annually and others annually.
- Triggers override the schedule: a breach, a rating drop below your minimum, a material service or hosting change, a newly disclosed vulnerability or an expiring certificate.
- A point-in-time review goes stale quickly; continuous monitoring catches change between reviews.
- CyberRank reassesses monitored vendors nightly, raises events for rating changes, new breaches and privacy-policy changes, and can send questionnaires automatically to vendors below baseline.
What is a sensible reassessment cadence by tier?
Many programmes review critical vendors quarterly, high-risk vendors semi-annually and others annually, and monitor critical and high vendors continuously in between.
The right cadence is the one you can act on: monitoring 500 vendors daily is pointless if nobody triages the alerts. How tiers are set is explained in detail in our article about third-party risk management.
| Tier | Formal review | Between reviews | In CyberRank |
|---|---|---|---|
| Critical | Formal reviewQuarterly | Between reviewsContinuous monitoring | In CyberRankNightly reassessment and events |
| High | Formal reviewSemi-annually | Between reviewsContinuous monitoring | In CyberRankNightly reassessment and events |
| Medium | Formal reviewAnnually | Between reviewsEvent-triggered | In CyberRankMonitoring period set per vendor |
| Low | Formal reviewAnnually or at renewal | Between reviewsEvent-triggered | In CyberRankRating on demand |
Which events should trigger an out-of-cycle review?
Any event that changes what you assumed when you accepted the vendor.
Why a disclosed flaw at one supplier can reach many customers is explained in detail in our article about supply chain attacks.
| Trigger | Action | How CyberRank surfaces it |
|---|---|---|
| Rating falls below the minimum for the vendor's tier | ActionSend a targeted questionnaire; agree remediation | How CyberRank surfaces itRating-change event; automatic questionnaire below baseline |
| Confirmed breach affecting your data | ActionIncident response and regulatory assessment | How CyberRank surfaces itNew data-breach event |
| Material service, ownership or hosting change | ActionOut-of-cycle reassessment | How CyberRank surfaces itHosting and data-residency checks; privacy-policy change event |
| Newly disclosed vulnerability in technology the vendor uses | ActionAsk the vendor to confirm exposure and patch status | How CyberRank surfaces itVulnerability signals in the nightly reassessment |
| Certificate expiry | ActionRequest renewal evidence | How CyberRank surfaces itQuestionnaire and evidence expiry dates |
Why is a point-in-time assessment not enough?
Because a vendor's exposure changes every day, while a one-off review only describes the day it was done.
See the glossary entries on point-in-time assessment and continuous monitoring for the difference. CyberRank combines both: a full assessment when you onboard a vendor, then nightly reassessment for as long as you monitor it.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating