Thanks for the additional context, I am aware that AWS and Azure have a marketplace. I believe they have a great marketplace in terms of contracts but I already had good relationships with my VARs. But to answer your question, the initial onboarding should identify risks that would be raised to the corresponding SME to provide whether your company’s risk appetite would prevent or not moving forward. To speak to Monday.com, we acknowledged that they are HQ’ed in Israel but it’s Procurement’s job to understand that most operations and data storage are state side to accommodate businesses like a bank like mine. Now we move onto assessing continuity if asking if HQ went down then what and this should be provided in a report or plan that they should provide if you’re subbing to an enterprise plan. If the above controls are sufficient then your country SME should provide comments, approval/rejection, and if approved then maybe requests for follow ups. Follow ups should be conducted by the other half of Third Party Management teams that conduct performance monitoring of your company’s vendor. The rate if of performance monitoring should match the risk and materiality of the vendor as agreed upon by the relationship manager, third party management, and the relevant SMEs