The Double-Edged COTS IT Sword

As government technical teams downsize and budgets shrink in tandem with an increasing demand for more complex systems, there is a rising interest in leveraging the use of commercial-off-the-shelf (COTS) products. In many cases, the use of COTS is mandated. Is it possible to over-emphasize the use of COTS products? For example, what checks would you expect prior to flying on a new aircraft with a software system composed of integrated COTS? Far from the promised panacea, the use of COTS components introduces new trade-offs and issues, especially with risk management, component integration, system reliability, and cost of sustainment. Is there a limit to what can be defined as COTS? Can all future deliverables of a developed product be considered COTS? If so, what is the implication for Department of Defense (DoD) acquisitions? The new DoD Directive 8000.1 for the Management of DoD Information and Information Technology (IT) (http://www.cio.hq. af.mil/dodctext.htm) sharpens the blades of COTS and outsourcing policies by providing the mechanism for DoD compliance with the Cohen-Clinger Act (also known as the IT Management Reform Act of 1996 (see CROSSTALK, September 1997). It applies to all DoD IT, even IT in national security systems (to include embedded, crypto, intelligence, and command and control systems). In other words, the law and the new DoD directive provide an all-encompassing definition of information and IT. DoD Directive 8000.1 requires an assessment of where the IT function could be performed most effectively: within DoD, by another government source, or in the private sector. It also advocates the principal of fee-for-service in governing the provisioning of information services and IT capabilities. Considering the law and the new DoD directive, how far can the use of COTS be applied (and pressure applied by external sources)? Consider space-based capabilities that have been delivered before, especially since they are now covered by the IT umbrella. Why couldn’t DoD simply be expected to request an on-orbit COTS (or COTSbased) system with a specified capability, capacity, and availability in a particular orbit by a specified date? Based on the The Double-Edged COTS IT Sword