For operators of essential services, vendor choice is no longer just procurement - it is a long-term cyber-resilience decision shaped by regulation, continuity, and exit risk.