Building survivable systems out of commercial off-the-shelf (COTS) components is a daunting task, primarily because you have little or no access to the artifacts of the software engineering process used to create the components. One way to partially compensate is to use vendor risk assessments as a tool to help you build, maintain, and evolve survivable COTS-based systems.