Six months after signing, a city's EHR hosting vendor changes subprocessors and suffers a regional outage. Why is ongoing vendor monitoring still required?
Select an answer to reveal the explanation.
Short Explanation
Signing the contract isn't the finish line—it's mile one. Vendors swap partners, break, and drift, so you keep watching them like a weather radar, not a trophy on the shelf.
Full Explanation
Vendor monitoring is a continuous third-party risk activity that tracks control posture, incidents, subprocessor changes, and performance after onboarding. Risk is not static at signature; regional outages and supply-chain changes can alter exposure and require reassessment, reporting, and possible contractual remedies.