(1) Where the Minister makes an assessment -

(a) in accordance with section 21, that there is a likelihood of a vendor being subjected to interference by a third country,

(b) that there is a significant risk that a vendor will not be able to secure supply of critical components,

(c) that the overall quality of critical components supplied by a vendor is inadequate, or

(d) that the cybersecurity practices of a vendor are inadequate, the Minister may take measures in accordance with section 25.

(2) The Minister may conduct an assessment under subsection (1) at any time and on an ongoing basis.