Does your organization have a formal process to monitor critical suppliers, services, and products for changes in their risk profiles and update their criticality assessments accordingly?

This question assesses whether your organization maintains ongoing visibility into supply chain risks rather than treating vendor risk as a one-time assessment. Changes in a supplier's security posture, ownership, geographic location, or financial stability can significantly impact the risk they pose to your organization. Evidence could include a documented supplier monitoring procedure, risk reassessment schedules, examples of updated risk profiles following significant supplier changes, meeting minutes from supplier review sessions, or reports from a third-party risk management platform showing regular monitoring activities.