How often should third-party risk monitoring run under DORA and NIS2?

Continuously, not annually. ENISA's technical implementation guidance for NIS2 requires a live, updated register of suppliers reflecting ongoing risk management activity. DORA's oversight provisions expect the same standard. A once-a-year questionnaire cannot produce evidence for the other 364 days of the year.