What it asks for. Regularly monitor, review and evaluate how suppliers deliver services and manage their security practices, and control changes to those services.
In practice. Each important supplier has an owner who tracks performance against the agreed security requirements, using service reports, certifications, audit reports, incident notifications and periodic review meetings. Findings feed back into risk assessments, and material changes on either side, such as new subcontractors, hosting locations or service features, go through an assessment before they take effect. Evidence includes a supplier register with criticality ratings, minutes or records of reviews, tracked remediation actions and change assessments.
Common gaps. Due diligence is often thorough at contract signature and then stops, so later changes by the supplier go unnoticed. Reviews tend to focus on commercial service levels rather than security, and fourth parties used by the supplier are rarely tracked.