Question: Are suppliers monitored for security incidents, performance degradation, or regulatory non-compliance?

Why This Matters

Continuous monitoring detects early signs of supplier failure or compromise. Visibility enables swift containment before cascading impact.

Maturity

0 — Unaware
No post-onboarding monitoring.

1 — Ad Hoc
Reviews triggered only after issues arise.

2 — Defined
Quarterly reviews of critical vendors using basic KPIs.

3 — Managed
Feeds from news, CERT, and SOC integrated into monitoring.

4 — Integrated
Automated alerts for breaches, expiries, and SLA breaches.

5 — Optimized
Predictive analytics flag at-risk vendors before incidents occur.

How to Level Up

| From → To | Actions | |—|—| | 0 → 1 |Log supplier issues manually in a register.| | 1 → 2 |Define quarterly performance/security review schedule.| | 2 → 3 |Subscribe to breach and news monitoring for key vendors.| | 3 → 4 |Automate feeds (CERT-In, Have I Been Pwned, RSS).| | 4 → 5 |Correlate vendor risk with incident and SLA data for forecasting.|

Enablers

People: Procurement Lead, SOC Analyst, Compliance Officer
Process: Monitor → Detect → Review → Act
Technology: TPRM tool, RSS monitor, threat-intel feed

Evidence

Monitoring policy and logs
Escalation records
Vendor incident notifications

KPIs

Number of alerts per month
Average time to vendor response
Percentage of vendors under continuous watch

Low-Cost / Open-Source Options (MSME)

Common Pitfalls

Relying solely on vendor self-reporting
No defined escalation path
Monitoring not linked to risk register

Compliance Mapping