Sanctions, export controls and compelled access can turn a critical vendor into a continuity event. A board-ready framework — map, measure, mitigate — for CISOs to govern geopolitical vendor dependency in 2026.