Periodic Assessment

What periodic assessment is for

A periodic assessment is the control checkpoint that keeps third-party assurance current. It helps an organisation confirm whether a vendor still meets the requirements that justified the relationship, without treating every review as a fresh procurement event.

That distinction matters because vendor risk is not static. A supplier can remain contractually engaged while its security posture, operating model, or control maturity drifts away from what was originally approved.

What it reviews and why

The review usually asks whether the vendor still satisfies the required control set, whether evidence is current, and whether any material changes have occurred in scope, hosting, subprocessors, access patterns, or incident history. The exact checklist varies by programme, but the purpose is consistent: validate continued fit against accepted risk.

In practice, periodic assessment sits between onboarding and full requalification. It is a renewal of trust based on evidence, not a re-run of initial diligence unless the change is significant enough to demand one.

Because the term is used across third-party risk, cloud governance, and assurance programmes, definitions vary slightly across vendors and frameworks. The common thread is scheduled reassessment against stated requirements, not ad hoc opinion.

How it differs from onboarding and continuous monitoring

Onboarding establishes whether the vendor is acceptable at the start. Continuous monitoring watches for material drift between reviews. Periodic assessment is the formal checkpoint that decides whether the vendor still belongs in the approved state when the next review cycle arrives.

This makes it a governance tool as much as a security one. It helps risk owners avoid two common failures: assuming the original due diligence remains valid forever, or escalating every minor change into a complete reassessment.

The cadence should reflect the sensitivity of the service, the criticality of the data or access involved, and the vendor’s change rate. Faster-changing or higher-impact suppliers usually justify more frequent review.

What a strong assessment should prove

A useful periodic assessment should produce an evidence-based answer to three questions: has the vendor materially changed, do the required controls still exist, and does the current posture still align with the risk appetite originally accepted?

That is why reviewers look for current attestations, policy or control evidence, significant incident updates, and exceptions that affect scope or assurance. When a vendor’s control environment has changed materially, the organisation should be able to show why the relationship remains acceptable, or why it should be escalated.

CSA Cloud Controls Matrix is a useful reference when periodic assessment is being used to map vendor controls to a cloud security baseline, while SOC 2 Trust Services Criteria (AICPA) is often used when the review needs an assurance-oriented control lens.

Risk and Threat Considerations

Periodic assessment reduces the risk of stale trust, but it can fail if teams treat it as paperwork instead of evidence. A vendor may look compliant on last year’s artefacts while current controls, access patterns, or subprocessor dependencies have already drifted beyond the accepted risk.

Failure mechanism: The organisation accepts an unchanged status by default, misses material change, and keeps relying on a supplier whose actual posture no longer matches the approved baseline.

Impact: That can leave sensitive data, privileged integrations, or critical services exposed to control gaps that were never re-approved, and it can delay escalation until after an incident or assurance failure.

Practitioner Guidance

Governance implication: Treat periodic assessment as a decision point, not a documentation exercise. The review should have a clear owner, a defined control set, and an explicit rule for when a change in the vendor’s posture triggers escalation, remediation, or a fresh approval path.

What to watch for: Pay close attention to scope changes, ownership changes, newly introduced subprocessors, unresolved exceptions, and material incidents since the last review. Those are the signals that usually determine whether the relationship is still operating within accepted risk.

Practitioner takeaway: The best periodic assessments compare the vendor’s current evidence to the risk that was originally accepted, then decide whether that acceptance still holds.

Related resources from NHI Mgmt Group

• What breaks when application vulnerability assessment is only done as a periodic scan?
• Why do AI security programs need continuous risk assessment rather than periodic reviews?
• What is the difference between attack surface visibility and periodic security assessment?
• Why does periodic vendor assessment miss third-party access risk?