The company formally monitors the security posture of its key suppliers throughout the relationship
Committing to monitor key suppliers' security posture for the life of the relationship extends A.5.19's assessment past the onboarding moment, where most gaps open up over time.
Committing in policy to monitor key suppliers' security posture for the whole relationship supports A.5.22's review requirement, but the commitment alone does not perform the review or change management the control also names.