Use the annual questionnaire for depth and continuous monitoring for freshness. A questionnaire tells you what a vendor says at one moment. Monitoring watches for change in between. Most teams do best with both for critical vendors and the questionnaire alone for the rest.
What each approach does
An annual questionnaire is a structured review: answers, evidence, contract check. It captures policy, process and context. It is a snapshot, and the vendor's answers age from day one.
Continuous monitoring means regularly checking signals about a vendor between reviews. Typical sources are public security pages, certificate expiry, subprocessor changes, published incidents and security advisories. Some teams also add external scoring services. Their outputs are indicators, not verdicts, and you should check them for false positives before you act.
Comparison
| Question | Annual review | Continuous monitoring |
|---|---|---|
| Depth | High | Low per signal |
| Freshness | Stale within months | Current |
| Effort | Concentrated, heavy | Light but constant |
| Weakness | Self reported | Sees only the outside |
| Best for | Understanding controls | Catching change |
What each misses
A questionnaire misses events between reviews: an acquisition, a breach, a lapsed certificate. Monitoring misses internal practice: how the vendor handles access, change and data. Neither proves a vendor is secure.
A practical blend
- Critical vendors. Annual deep review plus monitoring of certificate expiry, subprocessor notices, breach news and your own usage.
- Standard vendors. Review every two years or on a trigger. Subscribe to their notices.
- Low vendors. Check at renewal.
Triggers for an early review
- The vendor is acquired or merges.
- A security incident is reported.
- A new product feature changes the data it handles, such as an AI feature.
- A new subprocessor appears.
- A key certificate or report lapses.
- Your use of the vendor grows.
Own-side monitoring
You can watch your side of the relationship without any vendor data: which accounts exist, which tokens are active, which integrations call your systems. This often finds more risk than outside scoring. Safeguard's asset discovery and policies, gates and guardrails can support that inventory work for software and services in your environment.
Avoid alert fatigue
If monitoring produces more signals than you can read, narrow it. Pick three signals per critical vendor and assign an owner. A short list that someone reads beats a long dashboard nobody opens.
See how to tier vendors for matching depth to tier.
Quick check
Can continuous monitoring replace the questionnaire?
No. It sees outside signals only. You still need to understand controls, contract terms and evidence.
Do low-risk vendors need monitoring?
Usually not. Check them at renewal and respond to any public incident you hear about.
Last reviewed: 19 October 2026.
