A vendor security questionnaire is completed once at onboarding. The service later becomes business-critical. What should happen?

1. Repeat only the original questionnaire without reviewing its scope
2. Rely on the supplier's original low-risk classification indefinitely
3. Treat onboarding as permanent approval
4. Reassess the supplier based on the changed criticality and define ongoing oversight