What is the purpose of ongoing monitoring in vendor risk management?

• A. To validate vendor pricing and contract terms on a quarterly basis.
• B. To monitor for changes in regulatory requirements only.
• C. To ensure the vendor's security controls remain effective and aligned with risks.
• D. To renew contracts automatically regardless of risk.

Answer: (C)

Ongoing monitoring keeps a continuous pulse on a vendor’s security posture and the evolving risk landscape tied to that relationship. The main purpose is to ensure the vendor’s security controls stay effective and aligned with current risks by regularly assessing control performance, vulnerability findings, incident history, and any changes in the vendor’s environment. This enables timely remediation, adjustment of risk treatment, or decisions about continuing, tightening, or ending the relationship based on current risk levels. It’s not primarily about validating pricing or contract terms, nor is it limited to monitoring regulatory changes, and automatic renewal regardless of risk would undermine risk management.