Question

A critical SaaS vendor passed a rigorous security assessment during onboarding two years ago. Since then, the vendor has undergone a major acquisition and migrated to a new cloud platform. The information security manager is concerned the original assessment no longer reflects the vendor's current risk posture. Which approach BEST addresses this concern going forward?

Accepted Answer

Establish a continuous vendor monitoring program with periodic reassessments triggered by defined events and risk tiers

Answer

Require the vendor to submit an updated point-in-time assessment questionnaire immediately

Answer

Terminate the contract and issue an RFP to identify a lower-risk replacement vendor

Answer

Purchase additional cyber insurance to cover potential losses from the vendor relationship