the individual software components to comfortably address software assurance.
In many cases, conducting or providing for code review of COTS products
is not feasible or likely. Further, such tests, no matter the extent, depth, or
thoroughness of the testing, are often at the discretion of the DAA. The results of