Periodic Reassessment of Critical Vendors

A security assessment carried out at the start of the relationship with a vendor only reflects its posture at that moment, and that posture can deteriorate over time due to organizational changes, turnover of key staff, acquisitions or simple relaxation of controls nobody audits unless it's required again. Periodic reassessment, at a frequency defined according to the vendor's criticality, makes it possible to detect this deterioration before it turns into an incident, and it should also consider triggering events outside the regular cycle, such as a significant change in the service provided, the vendor's merger with another company, or a publicly reported security incident involving it. A frequent risk pattern is vendors approved several years ago that were never reassessed because the relationship worked well operationally, until an incident reveals that their security controls became obsolete in the face of current threats.