The COTS Trap in CMMC
"Commercial" Does Not Mean Exempt
One of the most persistent myths in the defense supply chain: "We use commercial applications, so we're exempt from CMMC." It sounds reasonable. It is wrong — and misreading this line is one of the most consequential scoping errors a contractor can make.
A COTS (Commercially Available Off-the-Shelf) item for CMMC is a commercial product sold in substantial quantities in the commercial marketplace and offered to the government without modification, as defined in FAR 2.101. The CMMC COTS exemption is real, but it is narrow and legally specific. Under DFARS 252.204-7021 and 32 CFR Part 170, the CMMC flowdown applies to commercial products and commercial services — but explicitly excludes true COTS items. The legal threshold from FAR 2.101 determines whether a subcontractor needs to satisfy NIST SP 800-171 controls, and without modification is not a guideline. It is the bright line.
What is the COTS exemption for CMMC?
Under FAR 2.101, a commercially available off-the-shelf item must be:
- 01Sold in substantial quantities in the commercial marketplace, and
- 02Offered to the government without modification, in the same form in which it is sold in the commercial marketplace.
All conditions must be satisfied simultaneously. Think literally: a COTS item is something you could walk into Best Buy, purchase today, and hand directly to the government without changing a single component, specification, or line of code.
Where does DFARS 252.204-7021 exclude COTS items from CMMC?
DFARS 252.204-7021(f) requires prime contractors to insert the CMMC clause in subcontracts "including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items, if the subcontract will contain a requirement to process, store, or transmit FCI or CUI."
Two conditions must both be met for the exemption to hold: the subcontract must be solely for a true COTS item as defined in FAR 2.101, and the subcontractor must not process, store, or transmit FCI or CUI. If either condition fails, the full flowdown applies.
When does modifying a commercial product void the COTS exemption?
Two fastener scenarios from CMMC assessor training illustrate exactly how thin this line is. Company A sells standard bolts to hardware stores and hands the identical bolt to DoD — pure COTS, exempt. Company B takes that bolt and machines it to custom tolerances specified in an F-35 technical drawing. The drawing is CUI. The product is no longer COTS. Company B now needs CMMC Level 2 and a C3PAO assessment.
The physical product may look nearly identical. The legal status could not be more different.
Is COTS software out of scope for CMMC if the environment handles CUI?
A SaaS platform that receives CUI is a different matter entirely. SaaS is a commercial service, not a COTS item. Upload CUI into a cloud platform and that environment must meet FedRAMP Moderate or High authorization — and enters your assessment scope. The commercial nature of the subscription creates no exemption.
How do you determine if a product qualifies as COTS for CMMC?
The Bottom Line
For every product or service in your supply chain, apply the three-step test: (1) verify it is sold to the general public in identical form, (2) confirm zero modifications were made for DoD specifications, and (3) confirm the subcontractor does not process, store, or transmit FCI or CUI. Document your COTS determination for each subcontract in your System Security Plan and scoping documentation. If any test fails, apply the full CMMC flowdown under DFARS 252.204-7021.
Audit every subcontract: list the product or service, apply the FAR 2.101 three-part test, document the COTS determination, and retain the evidence. For any product that fails the test, issue the CMMC flowdown clause. For SaaS and managed services, require FedRAMP Moderate authorization and confirm it in writing.