systems engineers to begin security engineering at the outset of the life
cycle, rather than attempting to “tack security on” at the integration phase],
DCID 6/3, NIACAP, and FISMA do not include C&A criteria specific to COTSbased systems. Nor do COTS components generally expose the security
information that will enable the certifier exact assessment of each component’s