GetWiki

{{Short description|Products that are not heavily customized}}{{Use American English|date = March 2019}}Commercial-off-the-shelf or commercially available off-the-shelf (COTS) products are packaged or canned (ready-made) hardware or software, which are adapted aftermarket to the needs of the purchasing organization, rather than the commissioning of custom-made, or bespoke, solutions. A related term, Mil-COTS, refers to COTS products for use by the U.S. military.In the context of the U.S. government, the Federal Acquisition Regulation (FAR) has defined "COTS" as a formal term for commercial items, including services, available in the commercial marketplace that can be bought and used under government contract.{{Citation |title=U.S. Federal Acquisition Regulations |section=2.101 Definitions |url=https://www.acquisition.gov/far/2.101|access-date=2022-06-22}} For example, Microsoft is a COTS software provider. Goods and construction materials may qualify as COTS but bulk cargo does not. Services associated with the commercial items may also qualify as COTS, including installation services, training services, and cloud services.WEB,weblink 2.000 Scope of part, Acquisition.gov, 2018-10-02,weblink 2017-01-30, dead, COTS purchases are alternatives to custom software or one-off developments – government-funded developments or otherwise.Although COTS products can be used out of the box, in practice the COTS product must be configured to achieve the needs of the business and integrated to existing organizational systems. Extending the functionality of COTS products via custom development is also an option, however this decision should be carefully considered due to the long term support and maintenance implications. Such customized functionality is not supported by the COTS vendor, so brings its own sets of issues when upgrading the COTS product.The use of COTS has been mandated across many government and business programs, as such products may offer significant savings in procurement, development, and maintenance.Motivations for using COTS components include hopes for reduction system whole of life costs. In the 1990s, many regarded COTS as extremely effective in reducing the time and cost of software development.{{Citation needed|date=October 2016}} COTS software came with many not-so-obvious tradeoffs – a reduction in initial cost and development time over an increase in software component-integration work, dependency on the vendor, security issues and incompatibilities from future changes.McKinney, Dorothy "Impact of Commercial-Off-The-Shelf (COTS) Software and Technology on Systems Engineering" {{Webarchive|url=https://web.archive.org/web/20200731224957weblink |date=2020-07-31 }}, Presentation to INCOSE Chapters, August 2001, accessed January 28, 2009

Software and services

COTS software and services are built and delivered usually from a third party vendor. COTS can be purchased, leased or even licensed to the general public.COTS can be obtained and operated at a lower cost over in-house development,{{Citation needed|date=October 2017}} and provide increased reliability and quality over custom-built software as these are developed by specialists within the industry and are validated by various independent organizations, often over an extended period of time.{{Citation needed|date=April 2021}}

Security implications

According to the United States Department of Homeland Security, software security is a serious risk of using COTS software. If the COTS software contains severe security vulnerabilities it can introduce significant risk into an organization's software supply chain. The risks are compounded when COTS software is integrated or networked with other software products to create a new composite application or a system of systems. The composite application can inherit risks from its COTS components.WEB,weblink Supply-Chain Risk Management: Incorporating Security into Software Development, Department of Homeland Security: Build Security In, Ellison, Bob, Woody, Carol, 2010-03-15, 2012-12-17, 2013-02-18,weblink dead, The US Department of Homeland Security has sponsored efforts to manage supply chain cyber security issues related to the use of COTS. However, software industry observers such as Gartner and the SANS Institute indicate that supply chain disruption poses a major threat. Gartner predicts that "enterprise IT supply chains will be targeted and compromised, forcing changes in the structure of the IT marketplace and how IT will be managed moving forward".WEB,weblink Maverick Research: Living in a World Without Trust, MacDonald, Neil, Valdes, Ray, 2012-10-05, 2012-12-17, Also, the SANS Institute published a survey of 700 IT and security professionals in December 2012 that found that only 14% of companies perform security reviews on every commercial application brought in house, and over half of other companies do not perform security assessments. Instead companies either rely on vendor reputation (25%) and legal liability agreements (14%) or they have no policies for dealing with COTS at all and therefore have limited visibility into the risks introduced into their software supply chain by COTS.WEB,weblink SANS Survey on Application Security Programs and Practices, Bird, Jim, Kim, Frank, December 2012, 2012-12-17,

Issues in other industries

In the medical device industry, COTS software can sometimes be identified as SOUP (software of unknown pedigree or software of unknown provenance), i.e., software that has not been developed with a known software development process or methodology, which precludes its use in medical devices.WEB,weblink Build and Validate Safety in Medical Device Software, Medical Electronics Design, Hobbs, Chris, 2012-01-04, 2012-12-17, In this industry, faults in software components could become system failures in the device itself if the steps are not taken to ensure fair and safe standards are complied with. The standard (IEC 62304|IEC 62304:2006 "Medical device software – Software life cycle processes") outlines specific practices to ensure that SOUP components support the safety requirements for the device being developed. In the case where the software components are COTS, DHS best practices for COTS software risk review can be applied. Simply being COTS software does not necessarily imply the lack of a fault history or transparent software development process. For well documented COTS software a distinction as clear SOUP is made, meaning that it may be used in medical devices.WEB,weblink Medical Devices & Technology, www.qnx.com, 1 April 2018, WEB,weblink Medical Design - Machine Design, medicaldesign.com, 1 April 2018,

Obsolescence

A striking example of product obsolescence are PlayStation 3 clusters, which used Linux to operate. Sony disabled the use of Linux on the PS3 in April 2010,WEB,weblink PlayStation Support, us.playstation.com, 1 April 2018, leaving no means to procure functioning Linux replacement units."US Air Force gets a migraine from Sony's latest PS3 update"( {{Webarchive|url=https://web.archive.org/web/20120820075504weblink |date=August 20, 2012 }}) In general, COTS product obsolescence can require customized support or development of a replacement system. Such obsolescence problems have led to government-industry partnerships, where various businesses agree to stabilize some product versions for government use and plan some future features, in those product lines, as a joint effort. Hence, some partnerships have led to complaints of favoritism, to avoiding competitive procurement practices, and to claims of the use of sole-source agreements where not actually needed.There is also the danger of pre-purchasing a multi-decade supply of replacement parts (and materials) which would become obsolete within 10 years. All these considerations lead to compare a simple solution (such as "paper & pencil") to avoid overly complex solutions creating a "Rube Goldberg" system of creeping featurism, where a simple solution would have sufficed instead.{{clarify|date=August 2012}} Such comparisons also consider whether a group is creating a make-work system to justify extra funding, rather than providing a low-cost system which meets the basic needs, regardless of the use of COTS products.Applying the lessons of processor obsolescence learned during the Lockheed Martin F-22 Raptor, the Lockheed Martin F-35 Lightning II planned for processor upgrades during development, and switched to the more widely supported C++ programming language. They have also moved from ASICs to FPGAs. This moves more of the avionic design from fixed circuits to software that can be applied to future generations of hardware."F-35 jet fighters to take integrated avionics to a whole new level." Military & Aerospace Electronics, 1 May 2003.COTS components are part of upgrades to the sonar of United States Navy submarines."U.S. Navy Selects Lockheed Martin for Submarine Sonar Upgrades." ({{webarchive |url=https://web.archive.org/web/20110118005704weblink |date=January 18, 2011 }})

See also

• Commercial software
• Commodity off-the-shelf
• Government off-the-shelf
• Non-developmental item
• Host Based Security System
• Independent software vendor
• Invented here
• Open Trusted Technology Provider Standard
• Turnkey

References

Citations

{{Reflist}}

Sources

• "Commercial" is not the opposite of Free-Libre / Open Source Software (FLOSS)