In late May 2023, a ransomware group began mass-exploiting a zero-day vulnerability in the MOVEit Transfer managed file transfer product. Many organizations whose data was stolen had never installed MOVEit themselves; their payroll providers, benefits administrators and pension services had. In security teams that week, the first question was simple and hard to answer: which of our vendors use this?
On the CompTIA Security+ SY0-801 exam, vendor monitoring and its limits sit under objective 5.3, which expects you to explain how third-party risk is assessed and managed over time. This lesson covers the vendor registry, right-to-audit clauses, vendor assessments, compliance attestations, service-level monitoring and penetration testing of vendors under rules of engagement. It then covers the practical constraints, including vendor lock-in, that limit how much assurance you can get.
Vendor risk keeps changing after the contract is signed
Due diligence is a snapshot. After signing, vendors get acquired, lose key staff, cut costs, add subprocessors, move data to new regions, ship features that touch more of your data, and sometimes get breached. Your own use changes too: a pilot holding test records becomes a production system holding customer data.
Vendor monitoring is the ongoing process of checking that a vendor still meets your requirements, at a depth set by its risk tier. Scheduled reviews handle the steady state, and certain events trigger an out-of-cycle review: a breach at the vendor, news of an acquisition or financial trouble, a change in the data you send, a new regulation, or an upcoming renewal. Monitoring ends with offboarding, when the vendor's access is revoked and it confirms in writing that your data has been returned or destroyed.
A vendor registry is the inventory that monitoring depends on
A vendor registry, sometimes called a vendor inventory, is the authoritative list of every third party the organization uses, with what each one does, what it can touch and how risky it is. A record for a critical vendor might look like this:
Vendor: Northwind Payroll Services
Service: Payroll processing (SaaS)
Business owner: Director of HR Operations
Risk tier: 1 (critical)
Data: Employee PII, SSNs, bank account numbers
Access: SFTP upload only; no network or VPN access
Subprocessors: Public cloud hosting (US region); print-and-mail vendor
Contract: MSA signed 2024-03-01, renews 2027-02-28; right to audit: yes
Evidence: SOC 2 Type II, period ended 2026-06-30; pen test summary 2026-04
Last assessment: 2026-07-15 Next review due: 2027-07-15
Incident contact: Vendor security team, 24x7 phone line on file
The registry is what lets the organization answer the MOVEit question in hours instead of weeks. It also drives the rest of the program: scheduling reassessments, flagging expired SOC reports, routing a vendor's breach notice to the right internal owner and reviewing vendors before renewal. Comparing accounts payable and corporate card records against the registry is a reliable way to find shadow IT, the SaaS tools a department bought without review. A vendor that isn't in the registry can't be monitored.