Working with IT vendors always carries some degree of risk. Managing these risks and pressing vendors to comply with internal and external standards and regulations only solves one part of this risk. Evaluating vendor responses to adverse events offers a more complete view into a provider’s fit in your organization.