Third-party service health is monitored

NIST AU-6 requires ongoing monitoring of system activity, which includes the health of external dependencies your system relies on. A Stripe outage that takes down your checkout flow is functionally indistinguishable from your own application failing — from the user's perspective, payments are broken. The difference is your response: if you know Stripe is the cause within two minutes, you update your status page and notify users; if you spend 45 minutes debugging your own code first, your response is slower and your customers are angrier. Third-party service health monitoring is free (status page subscriptions) and takes minutes to configure — the gap between "configured" and "not configured" is purely awareness.

Subscribe to the status pages of your critical dependencies so you receive email or Slack alerts the moment they report an incident.

Key subscriptions for most SaaS products:

• Stripe: https://status.stripe.com (email + Slack webhook available)
• Supabase: https://status.supabase.com
• Vercel: https://www.vercel-status.com
• Resend: https://resend-status.com
• SendGrid: https://status.sendgrid.com

Document subscriptions in docs/operations.md:

## Third-Party Status Pages
- Stripe: https://status.stripe.com (subscribed: email + #ops Slack)
- Supabase: https://status.supabase.com (subscribed: email)
- Vercel: https://www.vercel-status.com (subscribed: email)

For automated monitoring, your uptime tool (Better Stack, Pingdom) can add external URL checks that alert when a vendor status page stops returning 200.