Annual reviews miss fast-changing threats such as exposed credentials, breached suppliers, DNS or SSL anomalies, subcontracting changes, and financial stress that can signal delivery problems. That creates blind spots between review cycles, especially for critical services. Under DORA, those gaps can delay escalation, slow remediation, and leave institutions unable to react before service impact spreads.
Why annual vendor review breaks under DORA
Annual review cycles assume vendor risk is relatively stable, but DORA treats operational resilience as a moving target. A supplier can change credentials, hosting, subcontractors, security posture, or service dependencies long before the next questionnaire is due. That means the institution may hold an approval on paper while the real delivery risk has already shifted.
That gap matters most for critical or important functions, where service continuity depends on knowing when a third party has drifted out of tolerance. The longer the blind spot, the more likely the institution is to detect a problem only after a security event, service degradation, or escalation threshold has already been crossed.
For a practical DORA view of why this matters, the EU Digital Operational Resilience Act (DORA) puts ICT third-party risk management, incident reporting, and resilience testing in the same operating model, not in separate annual review silos.
What annual reviews miss between checkpoints
continuous monitoring is meant to catch change, not just confirm a point-in-time attestation. The most damaging misses are often not dramatic failures, but small signals that accumulate: exposed credentials, DNS or SSL anomalies, unusual authentication patterns, new subcontracting relationships, weak service health, or signs of financial stress that can precede delivery problems.
Those signals matter because they can change the probability and impact of compromise without changing the vendor’s questionnaire answers. A supplier that was acceptable at review time can become a much larger operational and security dependency a month later, especially when it supports shared platforms, managed services, or data flows that are hard to unwind quickly.
DORA’s third-party focus makes that shift especially relevant for oversight of critical ICT services. NHIMG’s Third-Party Risk Management Guide and DORA Guide both align with the need to treat vendor status as something to be watched continuously, not frozen at the last review date.
Where continuous evidence collection is needed, Audit Evidence and Continuous Controls Monitoring Guide shows why stale evidence is often the real failure mode, not the absence of a formal review process.
Why the governance consequence is faster than the review cycle
Under DORA, the institutional problem is not only that risk changes, but that response authority also lags. If oversight is tied to annual review, escalation may wait for the next scheduled meeting even when the supplier’s exposure has already become material. That delay can slow remediation, postpone contract or control actions, and let impact spread before owners know they need to intervene.
Annual review also weakens the institution’s ability to prove it is supervising critical providers actively. If a supplier problem emerges and the record only shows last year’s approval, the institution may struggle to demonstrate timely challenge, timely reassessment, or timely action. That is a governance weakness as much as an operational one.
The DORA view of that dependency is reinforced by NHIMG’s Financial Services Identity Security Guide, which ties financial-sector control decisions to third parties, privileged access, and regulated resilience expectations.
When review cadence is the control, the institution is often managing a calendar. When monitoring is the control, it is managing exposure.
Risk and Threat Considerations
Annual vendor reviews create a predictable blind window that adversaries and failure conditions can exploit. A supplier compromise, credential leak, subcontractor change, or service instability can mature fully between review dates, leaving the institution unaware until the issue affects production services or spreads to connected environments.
Failure mechanism: The control assumption is that the vendor’s risk state remains materially stable for months at a time, so fresh indicators are not continuously consumed, triaged, or escalated.
Impact: Institutions can miss early warning signs, delay containment or vendor challenge, and discover that critical service risk has already propagated into outage, compromise, or regulatory exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while DORA and SOC 2 (AICPA) define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Vendor monitoring cadence must align to ongoing operational resilience risk. |
| ID.SC-04 — Supplier Risk Management | Directly addresses ongoing oversight of third-party providers and suppliers. | |
| DE.CM-01 — Networks and Systems Are Monitored | Continuous monitoring is the mechanism that catches changing supplier indicators. | |
| Recommendation — Set a monitoring cadence that matches third-party risk volatility. Continuously reassess supplier exposure and dependencies. Monitor supplier-connected services for change and anomalies. | ||
| NIST SP 800-53 Rev 5 | SR-6 — Supplier Assessments and Reviews | Requires ongoing supplier review activity beyond one-time due diligence. |
| SA-9 — External System Services | Third-party services need active oversight because delivery risk changes over time. | |
| Recommendation — Perform recurring supplier assessments and update risk decisions. Define monitoring and notification expectations for external services. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Covers supplier oversight, review, and ongoing service-provider assurance. |
| Recommendation — Track provider risk continuously and escalate material changes. | ||
| DORA | ICT Third-Party Risk Management | The subject is the operational resilience gap in third-party oversight under DORA. |
| Recommendation — Maintain continuous ICT third-party monitoring and escalation. | ||
| SOC 2 (AICPA) | CC9.2 — Risk Mitigation | Continuous vendor oversight supports ongoing risk response for service providers. |
| Recommendation — Review provider risk continuously and react to changes promptly. | ||
Practitioner Guidance
What to verify: Replace calendar-only review with a small set of live indicators that can change escalation priority, such as domain and certificate anomalies, leaked credential signals, subcontractor changes, and service-health deterioration. If the signal can affect a critical service, it should not wait for annual review.
Decision rule: If the vendor supports a critical or important function, treat continuous monitoring as the default and use annual review only as a governance checkpoint, not as the detection mechanism.
Practitioner takeaway: Under DORA, the question is not whether the vendor passed last year’s review, but whether you would know this week if its risk profile changed enough to threaten service continuity.
Related resources from NHI Mgmt Group
- What breaks when organizations rely on annual vendor assessments instead of continuous supply chain monitoring?
- What breaks when organisations rely on compliance reviews instead of continuous monitoring?
- What breaks when organisations rely on vendor questionnaires instead of continuous third-party identity monitoring?
- What breaks when financial institutions rely on manual access reviews instead of governed workflows?