You continuously validate a third party’s controls by writing down the state each critical control should be in, reading evidence of that state from sources you can check on a schedule set by the risk, and reopening the assessment whenever the evidence or the relationship changes. A questionnaire answered at onboarding tells you how the supplier looked that month. Continuous validation tells you how it looks now.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. This article applies it to suppliers. In third-party risk management (TPRM), which the Federal Reserve, the FDIC and the OCC describe as the work to “identify, assess, monitor, and control risks related to third-party relationships”, continuous validation turns an annual answer into a current one for the suppliers that matter most.
What does continuous validation of third-party controls mean?
It means checking, on a schedule set by risk, that a supplier’s controls still do what the supplier said they do. The Interagency Guidance on Third-Party Relationships of June 2023 says ongoing monitoring lets a banking organization “confirm the quality and sustainability of a third party’s controls and ability to meet contractual obligations”, and that it “may be conducted on a periodic or continuous basis.” The agencies also say they are not encouraging any specific approach, so the depth and frequency are the organization’s own choice, set by the risk of each relationship.
Other frameworks ask for the same outcome in their own terms. DORA, Regulation (EU) 2022/2554, requires contracts for ICT services that support critical or important functions to give the financial entity “the right to monitor, on an ongoing basis” the provider’s performance (Article 30(3)(e)). NIST CSF 2.0 asks that supplier risks be monitored “over the course of the relationship” (GV.SC-07), and that external service provider activities and services be monitored to find potentially adverse events (DE.CM-06).
Continuous does not mean every control is read every minute. It means the question stays open between reviews, and each control is checked as often as its evidence can change and as the relationship warrants, as the Continuous Control Assurance page explains.
How can organizations validate vendor controls instead of relying only on self-attestation?
Replace or support each self-attested answer with a source the supplier does not write on the day. The interagency guidance allows for this directly: “In certain circumstances, based on risk, a banking organization may also perform direct testing of the third party’s own controls.” The sources differ in what they can show and how current they are.
| Evidence source | What it shows | How current it is | What it cannot show |
|---|---|---|---|
| Questionnaire answers | They show the supplier’s policies, procedures and intentions. | They are as current as the day the supplier answered. | They cannot show whether a control operates. |
| Independent assurance reports, such as SOC 2 | They show what an auditor tested for a stated scope and period. | They are as current as the end of the period they cover. | They cannot show anything outside their scope or after their period. |
| Outside-in observation | It shows exposed services, misconfigurations, leaked credentials and known vulnerabilities that anyone on the internet can see. | It is as current as the last scan. | It cannot see controls inside the supplier’s network. |
| Control evidence read from the supplier’s systems | It shows whether the agreed controls, such as multifactor authentication, logging or backups, are in their expected state. | It is as current as the last read. | It cannot show controls outside the agreed scope, and it needs a contract clause and the supplier’s consent. |
| Contract and performance records | They show service levels met, incidents reported and notices of change, such as a new subcontractor. | They are as current as the last report the supplier sent. | They cannot show what the supplier did not report. |
A critical supplier needs several of these sources, because each one covers a gap in the others. How questionnaire answers and evidence are weighed against each other is the subject of Questionnaire-Based vs Evidence-Based Third-Party Risk Management (TPRM).
How to continuously validate a third party’s controls, step by step
The method has 8 steps, and it works with any tooling.
- Rank suppliers by criticality, as NIST CSF 2.0 outcome GV.SC-04 asks, and start with those that support critical activities or hold sensitive data.
- For each of those suppliers, choose the controls that protect your data and your service, and write the expected state of each one in terms a system or a reviewer can check.
- Choose the strongest evidence source the relationship allows for each control, and secure the right to it in the contract. The interagency guidance notes that a contract often establishes the right to audit and to require remediation.
- Set a frequency for each control from how fast its evidence can change and how much you depend on it.
- Record every result with the time its evidence was read, as pass, fail or undecided, and never count missing evidence as a pass.
- Define the events that reopen the assessment, so a change at the supplier triggers a review instead of waiting for the next cycle.
- Send each failure to a named owner at the supplier with a due date, and give it an internal owner on your side as well.
- Test the control again after the fix, and close the finding only on a passing retest.
Steps 5 and 8 are the same discipline an organization applies to its own controls, which How Automated Control Testing Decides Whether a Control Still Works explains in detail.
Which events should reopen a third-party assessment?
The interagency guidance lists the changes that ongoing monitoring should watch, and most of them make good triggers. They include changes to the third party’s strategy and its agreements with other entities, its financial condition and insurance, relevant audits and testing results, key personnel, its use of subcontractors and where they are located, and its response to new threats, vulnerabilities and incidents.
- A breach or incident notice from the supplier reopens the assessment of the controls the incident touched.
- A new or changed subcontractor reopens the review of the supplier’s own oversight of that subcontractor, which is the subject of What Is Fourth-Party Risk?
- A change in where data is stored or services are delivered reopens the review, and DORA requires contracts to oblige the provider to give advance notice of such a change (Article 30(2)(b)).
- A failed control, a drop in outside-in posture or an audit report with exceptions reopens the controls concerned.
- A change of ownership, a merger or a missed service level reopens the review of the relationship as a whole.
The EBA Guidelines on outsourcing arrangements of 2019 add the consequence that is easiest to forget. Where the risk, nature or scale of an outsourced function has materially changed, the institution should reassess whether the function is critical or important (paragraph 100), which can move the supplier into a deeper level of oversight.
What happens when a vendor’s controls deteriorate after onboarding?
Supplier weaknesses are often slow to close. Verizon’s 2026 Data Breach Investigations Report found that only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication on their cloud accounts. The same report found that breaches with third-party involvement reached 48% of all breaches.
When a supplier’s control fails, the response should follow a fixed order.
- The failure becomes a finding with an owner at the supplier and a due date.
- Your own team adds a compensating measure while the finding is open, such as restricting the supplier’s access to your systems or watching its activity more closely.
- If the gap cannot be fixed in time, a named person on your side accepts the risk with a reason and an expiry date.
- A repeated or unfixed failure is escalated under the contract, and the interagency guidance names “material or repeat audit findings” among the issues that ongoing monitoring should escalate.
- If the weakness persists, the exit plan applies. DORA requires that contracts can be terminated for evidenced weaknesses in the provider’s overall ICT risk management (Article 28(7)(c)), and it requires exit strategies for ICT services that support critical or important functions (Article 28(8)).
How do changes in vendor security posture affect risk?
A change in a supplier’s security posture changes the likelihood that a failure at the supplier reaches you, so it changes the risk of the relationship. That change belongs next to the enterprise risks the supplier supports, which is what NIST CSF 2.0 means when it asks that supply chain risk management be integrated into cybersecurity and enterprise risk management (GV.SC-03). A supplier whose posture weakens may also need a deeper level of oversight, which is the reassessment the EBA guidelines describe.
How does third-party risk management (TPRM) connect to Continuous Control Assurance (CCA)?
They share one chain. A supplier’s control has an expected state, evidence, a test, a result, a finding when it fails, a link to the risk it affects, remediation and a retest, exactly as an internal control does, and only the evidence sits outside your walls. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. In third-party work, the outside-in scans and the control evidence read with consent are that monitoring. Continuous Control Assurance then validates what the monitoring found, as the Continuous Control Assurance page sets out in its operating chain.
When the supplier’s results sit in the same control model as your own, they map to the same framework requirements and feed the same risk register, so the board sees one picture instead of a separate vendor report.
What does Continuous Control Assurance (CCA) mean for third-party risk management (TPRM) leaders?
It changes what the job produces. A TPRM team that works this way owns a set of expected states for its critical suppliers, the evidence rights in their contracts and the findings that follow, and it reports supplier risk in terms of controls and open exceptions instead of questionnaire completion rates. Contract negotiation matters more, because a right-to-audit clause and a consent to share evidence decide what the team can validate later. Low-risk suppliers need less attention, because the effort goes where the risk is.
An illustration: a critical supplier between reviews
This example is an illustration. The organization and the supplier are invented, and the example uses no figures.
A health insurer relies on a cloud-hosted claims processing supplier that holds member data. At onboarding, the insurer writes expected states for multifactor authentication on the supplier’s administrator accounts, logging to the supplier’s monitoring tool and backups on the agreed schedule. The contract carries a right-to-audit clause, and the supplier consents to having those controls read directly. The supplier’s SOC 2 report and outside-in observation cover the rest.
Some months later, a notice and a failed test arrive in the same week. The supplier sends the notice its contract requires about a new subcontractor for customer support, which reopens the review of how the supplier oversees that subcontractor. A scheduled read then shows that multifactor authentication was switched off for a group of administrator accounts during a migration, so the test records a failure. The finding goes to the supplier’s security lead with a due date, and the insurer narrows the supplier’s access to its own systems while the finding is open. The supplier restores the setting, the next read passes, and the finding closes on the retest with its history kept.
How DigitalXForce runs continuous validation of third-party controls
The AI-Powered Third-Party Risk Management (TPRM) module covers vendor onboarding, category questionnaires, AI-assisted document analysis and review and reassessment workflows, and every vendor gets its own score. External Risk View watches each supplier from the outside, and for critical suppliers, connectors read control evidence from the supplier’s own systems under the customer’s right-to-audit clause and with the supplier’s consent.
X-SPM is Extended Security Posture Management, the DigitalXForce capability that scores security posture across the enterprise and its vendors from the same control data. Findings that need action are triaged, escalated and tracked to closure in X-ROC, the XForce Risk Operations Center. Each stage of the supplier lifecycle is documented in How does DigitalXForce third-party risk management work?, and the case for moving from an annual cycle to continuous oversight is made in the comparison of continuous and annual vendor assessment.
Where DigitalXForce is not the answer
A startup or small company preparing its first SOC 2 report, with few critical suppliers, does not need continuous validation at this depth, and DigitalXForce Lite, which is hosted in the cloud with the same functionality as the full platform and a faster deployment, serves that case. Where contracts carry no right-to-audit clause and suppliers will not consent, no platform can read their controls directly, and validation runs on audit reports and outside-in observation until the contracts are renewed.
Questions about continuously validating third-party controls
How can organizations continuously assure third-party controls?
Write the expected state of each critical control at a supplier, read evidence of that state from sources you can check on a schedule set by risk, and reopen the assessment whenever the evidence or the relationship changes. Record every result with its date, send failures to an owner at the supplier and close each finding only on a passing retest.
How can organizations validate vendor controls instead of relying only on self-attestation?
Support each self-attested answer with a source the supplier does not write on the day: an independent audit report, outside-in observation, control evidence read from the supplier’s systems with its consent, or contract and performance records. US banking guidance allows direct testing of a third party’s own controls where the risk warrants it.
How can vendor evidence be continuously validated in third-party risk management (TPRM)?
Give each piece of evidence a source, a date and an expected state to test against, and read it again on a frequency that matches how fast it can change. Missing or stale evidence is recorded as undecided and never counted as a pass.
What happens when a vendor’s controls deteriorate after onboarding?
The failure becomes a finding with an owner at the supplier and a due date, and your team adds a compensating measure while it is open. A gap that cannot be fixed in time is accepted by a named person with an expiry date, repeated failures are escalated under the contract, and a persistent weakness leads to the exit plan.
How often should a third party’s controls be validated?
Validate them as often as the evidence can change and as the relationship warrants. US banking guidance expects more frequent monitoring for higher-risk relationships and prescribes no single approach, so a critical supplier’s key controls may be read far more often than a low-risk supplier is reviewed.
How does third-party risk management (TPRM) connect to Continuous Control Assurance (CCA)?
A supplier’s control goes through the same chain as an internal one: expected state, evidence, test, finding, risk, remediation and retest. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and TPRM applies it to controls whose evidence sits at the supplier.
Do suppliers have to agree to have their controls read directly?
They do. Reading control evidence from a supplier’s own systems needs a right-to-audit clause in the contract and the supplier’s consent. Where a supplier declines, validation runs on its audit reports, outside-in observation and contract records, and the limitation is documented.
Sources
- The Federal Reserve, the FDIC and the OCC issued the Interagency Guidance on Third-Party Relationships: Risk Management on 6 June 2023, published at 88 FR 37920 on 9 June 2023, at https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management. The right to audit is in section C.3.d, ongoing monitoring in section C.4, and the agencies’ comment on monitoring approaches is in the preamble, section E.3.
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), of 14 December 2022, applies from 17 January 2025, and Articles 28 and 30 were read from the Publications Office text at https://publications.europa.eu/resource/celex/32022R2554.
- The EBA published its Guidelines on outsourcing arrangements, EBA/GL/2019/02, on 25 February 2019, at https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf, and paragraph 100 is in section 14. Its final Guidelines on the sound management of third-party risk related to non-ICT services, EBA/GL/2026/09, published on 18 September 2026, will replace them once they apply.
- NIST published The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, on 26 February 2024, at https://doi.org/10.6028/NIST.CSWP.29, and outcomes GV.SC-03, GV.SC-04, GV.SC-07 and DE.CM-06 are in its Core.
- Verizon published the 2026 Data Breach Investigations Report Executive Summary at https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf.
- Every source above was read on 26 September 2026.
Do this once instead of every audit.
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
