A review of the third-party risk program shows that vendors handling sensitive data are assessed thoroughly at onboarding but never reassessed, even though several have since changed hosting providers. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
An onboarding assessment is a snapshot, and vendors don't stand still for the photo. You need ongoing monitoring that looks harder at the riskiest vendors and kicks in again when something big changes. Reassessing everyone the same way every year sounds thorough, but it's not risk-based and it burns effort on vendors that don't matter.
Full Explanation
Third-party risk changes over the life of a relationship: vendors change infrastructure, subcontractors, ownership and security posture. Ongoing monitoring addresses this by tiering vendors by the sensitivity of data and criticality of service, setting reassessment frequency by tier, and defining events, such as a hosting change or a reported breach, that trigger an earlier review. This keeps effort proportionate to risk while catching the changes that matter. Reassessing every vendor in full each year ignores risk, wastes resources on low-impact suppliers and may still miss a change that happens just after an assessment. A notice clause is useful, but relying on it alone means the organization only learns what the vendor chooses to disclose and still never verifies controls. Suspending contracts is a disruptive reaction that could harm business operations, and the decision to interrupt a service belongs to the business, not to the security function acting alone. Exam caveat: monitoring can combine reassessments with continuous signals such as attestation updates, breach notifications and performance against security terms. Operational check: confirm each vendor has an assigned tier, a next review date and a defined list of change triggers recorded in the vendor inventory.