Our approach draws on the consulting background described on our expertise page. See our editorial and quality standards for how we prepare these resources.
Not every vendor needs an annual full assessment. Review frequency should reflect risk, change, performance, contractual expectations, and the consequences of failure.
A cadence is a management methodology—not a universal legal rule. Adjust it to your obligations and circumstances.
Working checklist
- Critical: annual review plus event-driven review
- High: annual review
- Moderate: approximately every two years
- Low: onboarding review, then when meaningful change occurs
- All tiers: contract, insurance, issue, and performance monitoring as relevant
- All tiers: review after material incidents or relationship changes
A practical way to approach it
1Set the tier
Base cadence on data, access, criticality, financial exposure, physical presence, and regulatory context.
2Define review depth
A review can range from confirming basic facts to refreshing questionnaires and evidence.
3Add event triggers
Reassess after incidents, ownership changes, major service changes, new data access, serious performance issues, or material control gaps.
4Schedule before renewal
Leave enough time to resolve findings or change vendors before automatic renewal.
5Document deviations
If a review is deferred or shortened, record the reason and approval.
Common mistakes to avoid
- Applying annual reviews to every office supplier
- Letting critical-vendor reviews slip past renewal
- Confusing monitoring with a full reassessment
- Ignoring changes between scheduled reviews
- Presenting internal cadence as a legal requirement
A sensible schedule directs scarce time toward vendors whose failure would matter most.
Sources and further reading
- NIST Cybersecurity Framework 2.0
- NIST SP 800-161 Rev. 1: Supply Chain Risk Management
- CISA Cyber Guidance for Small Businesses
- FTC Cybersecurity for Small Business
These sources inform the methodology. Inclusion does not imply endorsement, certification, or applicability to every organization. The worked examples and decision prompts are PBW’s practical guidance.
This guidance is a general business resource, not legal, insurance, cybersecurity, or regulatory-compliance advice. Adapt it to your circumstances and obtain qualified advice when appropriate.