Six months after signing, a city's EHR hosting vendor changes subprocessors and suffers a regional outage. Why is ongoing vendor monitoring still required?
Select an answer to reveal the explanation.
Short Explanation
Signing the contract isn't the finish line—it's mile one. Vendors swap partners, break, and drift, so you keep watching them like a weather radar, not a trophy on the shelf.
Full Explanation
Vendor monitoring is a continuous third-party risk activity that tracks control posture, incidents, subprocessor changes, performance, and financial health after onboarding. Six months after signature, an EHR hosting vendor that changes subprocessors and suffers a regional outage demonstrates that third-party risk is not frozen at contract time. Continuous monitoring detects those changes, triggers reassessment, and supports decisions such as increased oversight, contract remedies, or exit planning for systems holding electronic health information. Selection paperwork does not permanently freeze all vendor risk at signature time. Static reliance on the original RFP package misses post-award drift in subprocessors, geography, and availability. Monitoring is not useful only before the RFP is published. Pre-award diligence matters, but post-award monitoring is where life-cycle changes like new subprocessors and outages are caught. Outages can and do affect confidentiality, integrity, and availability—especially availability for EHR hosting, and potentially integrity or confidentiality depending on failover and incident handling. Claiming outages never affect CIA is false. Exam caveat: Third-party risk management is continuous. After award, monitor for subprocessor changes, incidents, and service degradation rather than treating the signed contract as a permanent risk snapshot. Operational check: Require subprocessor notification clauses, review vendor status after outages, update the vendor risk rating, and verify EHR data protections remain acceptable under the new operating reality.