Vendor risk alerts: how to assess and respond to changing risk

A vendor passed its security review six months ago. Today, a breach report mentions the company. Your team needs to establish whether the incident affects the service you use, what exposure it creates, and who should act.