Vendorapp › OpenVMO › Ongoing monitoring
Ongoing monitoring in OpenVMO.
Monitoring keeps the register true after onboarding. Vendors are re-reviewed on a cadence set by their tier, expiring certificates and reports are chased, and events such as a breach, an acquisition or a sanctions listing trigger a review straight away.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Vendors change after you sign: they get acquired, change subprocessors, lose certifications or suffer breaches. Auditors check that your review dates are real and recent, not just that a review happened once.
Ongoing monitoring is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 5 MON practices.
Review cadence by tier
Vendors are re-reviewed on a cadence set by tier. The default is Tier 1 every year and on any event, Tier 2 every two years, and Tier 3 at renewal. Evidence: Last and next review dates in the register, with none overdue.
Assurance expiry tracked
Expiry dates of certificates, SOC 2 reports and bridge letters, and DPAs are tracked and chased before they lapse. Evidence: Expiry dates in the register and the follow-up for anything expired.
Event-driven review
Breach news, a sanctions listing, an acquisition or a material change in scope triggers a review. Evidence: Event-triggered review records, each with what triggered it.
Performance and SLA review
Tier 1 commercial relationships have a periodic review of performance against the agreed service levels. Evidence: Review notes or scorecards for each Tier 1 vendor.
Concentration view
You know which vendors, or shared fourth parties, support more than one critical service. Evidence: A concentration map or table, reviewed at least yearly.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | Renewals act as the review point, so nothing goes completely unchecked. |
| Level 2: Managed | Tier-based review cadence, expiring assurance chased, and events trigger reviews. |
| Level 3: Defined | Service-level reviews for Tier 1, and a view of concentration across critical services. |
| Level 4: Optimised | Continuous monitoring feeds (news, sanctions, security ratings) wired into the register. |
With a spreadsheet
Doing it without any special tool.
- Add "last review" and "next review due" columns, with conditional formatting for overdue.
- Add an "assurance expiry" column and sort by it at the start of each month.
- Set up news alerts on your Tier 1 vendors’ names.
Common mistakes
Where teams usually go wrong.
- Reviewing every vendor every year regardless of tier, then falling behind on all of them.
- Letting a SOC 2 report go stale without asking for the new one or a bridge letter.
- Hearing about a vendor breach and not recording a review.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2, CC4.1 |
| ISO/IEC 27001:2022 | A.5.22 |
| NIS2 and Implementing Regulation 2024/2690 | CIR 2024/2690 Annex §5.1 |
| DORA | Art. 28(6); Art. 29 |
| NIST CSF 2.0 | GV.SC-07, GV.SC-09 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Vendor register (CSV): The register with every OpenVMO minimum field as a column, plus two example rows. Open it in any spreadsheet.
- Measures sheet (CSV): The seven OpenVMO programme measures, with how to calculate each from the register.
All OpenVMO templates are on the templates page.
Previous domain: Contracts. Next domain: Fourth parties and supply chain.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.