Yes, especially when the service supports important operations or gives others access to sensitive information. Ask how the vendor selects and reviews the providers it relies on, handles unresolved issues, and tells customers about relevant incidents or changes. For an important dependency, request a recent example of a review and its follow-up, with sensitive details removed if necessary. A policy describes the intended process; an example helps you understand whether that process is being used.
Read more: What Should We Ask a Vendor About Its Fourth-Party Dependencies?.
