Does CMMC apply to COTS suppliers if you only deliver off-the-shelf products?
If you only deliver commercially available off-the-shelf products to a DoD buyer, the CMMC requirements do not apply to that contract or subcontract. The CMMC final rule exempts contracts and subcontracts that are exclusively for delivering COTS products, and COTS is defined in FAR 2.101. The exemption stops at the boundary of the delivery itself. If your own systems process, store or transmit CUI while you perform the work, a COTS product running inside those systems does not take your environment out of scope. The question is therefore not whether a product is off the shelf but what the contract requires you to deliver and where the defense data actually flows. A supplier that receives drawings, technical data or support tickets containing CUI is handling CUI, whatever it sells.
Check two things before you rely on the exemption. First, read the contract scope and statement of work to confirm that the deliverable is solely a COTS item and that no services, data exchange or engineering support are bundled with it. Second, map every system that touches defense information, including ticketing, email, file shares and remote support tools, and confirm which of them are part of the delivery and which are your own infrastructure. Your prime contractor decides what flows down to you. Under DFARS 252.204-7021, subcontracts for COTS items are excluded from the clause, but subcontracts for commercial services that involve CUI are not, so ask the prime in writing how it classifies your work.
Your organization owns its controls, and any implementation partner you bring in prepares systems, configurations and evidence on your behalf. Only an independent assessor or certification body issues an assessment report or certificate. Confirm current timing and assessment requirements with the contracting office and the DoW CIO CMMC page, because the Department of War suspended CMMC Phase II on 13 July 2026, while Phase I self-assessments and DFARS 252.204-7012 obligations remain in place.
What the COTS exemption covers and what it leaves out
The COTS exemption applies to contracts that exclusively deliver commercially available off-the-shelf products to a DoD buyer. It does not follow the product into the supplier's own systems, into custom work sold alongside it, or into support sessions that reach CUI, and each of those cases needs its own scope check.
Exclusive COTS delivery
A contract or subcontract that exclusively delivers COTS products to a DoD buyer falls outside the CMMC requirements, and the same carve-out appears in DFARS 252.204-7012 and FAR 52.204-21 for COTS items. The exemption turns on what the contract delivers, not on how the supplier describes itself. Check each solicitation and subcontract to confirm that nothing else is bundled into the deal, because any extra work changes the answer.
COTS products inside your own systems
The exemption covers the product you sell, not the tools you run. A COTS database, email service or collaboration suite that stores, processes or transmits CUI inside your environment is still part of your CMMC scope. Inventory every commercial product that touches CUI and treat each one as a system component to assess, configure and document.
Custom work bundled with a COTS sale
Customization, integration, engineering services or configuration work sold with a COTS product can take the deal out of the exemption. Once the supplier develops or modifies something for the buyer, the contract is no longer exclusively COTS delivery. Ask the contracting officer or prime how the statement of work is classified before you assume the exemption applies.
Support and maintenance access to CUI
Help desk staff, remote troubleshooting and maintenance sessions can reach systems that hold CUI even when the product sold was COTS. Any access path into a system that processes CUI counts toward your scope, regardless of whether the work is billed as support. Map who can connect, through which accounts and tools, and whether those sessions are logged and reviewed.
Flowdown decisions from primes
Primes decide which subcontracts receive the clause substance, and the COTS carve-out only covers subcontracts that exclusively deliver COTS items. A subcontract that involves handling FCI or CUI should carry the clause, even when the supplier sells commercial products. Confirm in writing how the prime classified your work, and keep that record with your contract file.
Why COTS products in your own systems are not exempt
The COTS exemption attaches to the contract and the delivery, not to the systems you use to do the work. When a contract or subcontract is exclusively for delivering commercially available off-the-shelf products to a DoD buyer, CMMC requirements do not apply to it. That relief does not extend to your own information systems. Once your company processes, stores or transmits CUI on a system, the safeguarding requirements attach to that system, regardless of whether the software running on it was bought as a commercial product. A commercial email platform, a file share, an engineering design tool or a ticketing system can hold drawings, specifications, test data or other CUI, and the product being commercial does not change where the obligation lands.
Walk through the systems that touch controlled information in a real workflow. A supplier that receives a technical data package by email, stores it in a cloud file share, discusses it in a ticket and archives a revision in an engineering tool has put CUI into four products that were each bought off the shelf. Each of those locations belongs in the scope of your assessment boundary, and the assessor will ask how access, encryption, logging and retention are handled in each. Make a data flow map that lists every product where CUI appears, including backups and exports, before deciding what is in scope. Illustratively, a machine shop that emails a drawing to a customer has a CUI copy in a mail system that a Level 2 assessment would need to cover.
DFARS 252.204-7012 and FAR 52.204-21 are written to apply to the contractor's own information systems, so the question is how each contract defines the covered systems and what the prime expects you to flow down. Check the clause language in each contract and ask the contracting officer how the scope is written, whether a CMMC level has been specified and which systems the program office considers covered. Confirm these points before you buy or configure anything, because a COTS product that you did not expect to be in scope can change your boundary, your evidence set and your cost of assessment.
How the answer changes by supplier situation
A supplier whose contracts and subcontracts exclusively deliver COTS products to a DoD buyer sits within the exemption in the CMMC final rule and the COTS carve-outs in DFARS 252.204-7012 and FAR 52.204-21. The question for this supplier is whether its contract is truly limited to COTS delivery. A reseller that also receives drawings, technical data or other CUI from the buyer, or that hosts a customer portal holding that data, is no longer in the simple case. Illustrative example: a distributor ships a commercially catalogued pump under a purchase order that includes only the item, its price and delivery terms.
- Scope: Usually limited to the contract itself. Confirm that the purchase order, quote and shipping documents contain no CUI.
- Evidence requested: A contracting officer or prime may ask for written confirmation that the work is COTS-only, along with the COTS definition in FAR 2.101 applied to the item.
- What you own: Contract review, order intake controls, and a record of which items and deliveries fall under the exemption.
- What a partner or assessor touches: Usually little. An implementation partner may help document the scoping decision, but no assessment is normally needed for a pure COTS delivery.
- Watch for: Scope creep through customer portals, engineering questions or attached specifications that quietly bring CUI into your systems.
Check every purchase order and portal account against the COTS-only test before you accept it.
A supplier that sells COTS items and also performs integration, configuration, customization or custom engineering is no longer delivering only COTS products. The work product, not the catalog item, drives the analysis. If the integration effort requires the buyer to share CUI, or if the supplier generates CUI while configuring or testing the system, the subcontract and the supplier's own systems can fall within DFARS 252.204-7021(f) and FAR 52.204-21(c). Illustrative example: a supplier installs a commercial network appliance and then writes site-specific configuration files based on a buyer's technical drawings.
- Scope: The supplier's systems that hold the drawings, configuration files, test records and related communications, along with the flowdown to any lower-tier subcontractors.
- Evidence requested: Expect questions about where CUI is stored and transmitted, which people have access, and whether the prime has flowed the clause down in writing.
- What you own: Data mapping, access control, encryption, incident reporting and the decisions about which work is COTS and which is custom.
- What a partner or assessor touches: An implementation partner can prepare the enclave, the configuration baselines and the evidence packages. Only an independent C3PAO assesses Level 2 certification where a contract requires it.
- Watch for: Splitting a single engagement into separate COTS and custom invoices. Assessors look at what the work actually does.
Confirm with the prime, in writing, which deliverables carry CUI and which systems hold it.
A supplier that uses COTS tools inside its own environment to process, store or transmit CUI is outside the COTS exemption no matter what it sells. The exemption covers delivery of COTS products to a DoD buyer, not the contractor's use of those products. Email, file sharing, identity platforms, endpoint tools and ticketing systems that touch CUI all fall within the NIST SP 800-171 Rev. 2 requirements that Level 2 incorporates. Illustrative example: a defense supplier that sells only standard parts still stores its engineering drawings in a commercial cloud file service.
- Scope: Every system component that processes, stores or transmits CUI, including the COTS products that run it and the administrators who manage them.
- Evidence requested: A system security plan, network diagram, asset inventory, and proof that each COTS component meets the applicable requirements and encryption expectations.
- What you own: The system security plan, configuration decisions, user access, the affirmation under 32 CFR 170.22 and the SPRS entry.
- What a partner or assessor touches: A partner can harden the COTS stack, document it and collect evidence. An independent assessor evaluates the Level 2 results where a certification assessment applies.
- Watch for: Shadow tools adopted by individual teams that were never inventoried.
Verify that every COTS tool holding CUI is named in your system security plan and asset inventory.
Which subcontracts carry the clauses down
This table compares three kinds of subcontract and shows how each one is treated under the CMMC flowdown clause, the DFARS 7012 safeguarding clause and the FAR 52.204-21 basic safeguarding clause. Read each row by first asking what the subcontractor supplies and whether any federal contract information or CUI reaches its systems. The main takeaway is that a COTS-only supplier usually falls outside the flowdown, but any subcontractor that touches CUI in its own environment does not.
| Subcontract type | DFARS 252.204-7021 flowdown | DFARS 252.204-7012 and FAR 52.204-21 treatment |
|---|---|---|
| COTS items only | Not flowed down. The prime does not need to pass the clause to a subcontract for COTS items. | DFARS 204.7304(c) excludes subcontracts solely for COTS items from 7012. Confirm the COTS definition in FAR 2.101 for each product. |
| Commercial products or services other than COTS, with FCI or CUI processed, stored or transmitted | Flowed down. The prime must include the clause when the subcontractor's systems will handle FCI or CUI. | Flowed down under 7012 and FAR 52.204-21 where the work involves covered information on the subcontractor's systems. |
| Commercial products or services other than COTS, where FCI may reside in or transit the subcontractor's system | Flowed down when the work involves FCI or CUI, even if the subcontractor expects little of it. | FAR 52.204-21(c) requires the clause where FCI may reside in or transit the subcontractor's information system. |
| Subcontracts that involve CUI | Flowed down. CUI handling in the subcontractor's systems triggers the clause regardless of contract type. | Flowed down under 7012. The subcontractor must meet the Level required by the contract, not only the basic safeguarding clause. |
| COTS product used inside the subcontractor's own CUI systems | Not exempt. The COTS exclusion covers delivery of the product, not its use in systems that process CUI. | Applies to the subcontractor's environment, so the subcontractor must still meet the requirements for that environment. |
How primes decide what to flow down to a COTS supplier
The prime contractor works through a short sequence of checks that decides which subcontracts must carry the CMMC and DFARS 252.204-7012 requirements and which can stay outside them. Each step leaves a written record that the supplier can ask to see.
Review the prime contract and solicitation
The prime's contracts or capture team reads the prime contract, the solicitation and its clauses to find whether DFARS 252.204-7012 applies and whether a CMMC level is specified. Under the current DFARS schedule, clause 252.204-7021 goes into contracts only when the program office or requiring activity specifies a CMMC level, so the solicitation language controls this step. The output is a contract review note that records the clauses present and any CMMC level stated.
Map which subcontracts touch CUI or FCI
The prime lists each planned subcontract and asks whether the subcontractor will process, store or transmit Federal contract information or Controlled Unclassified Information, either on its own systems or by receiving data under the work. Federal contract information excludes public information and simple transactional data such as payment processing details. The output is a subcontract inventory with a yes or no entry for FCI or CUI exposure and a short reason for each entry.
Classify each subcontract item as COTS or non-COTS
For each item the prime decides whether it is a commercially available off-the-shelf product as defined in FAR 2.101, or whether it is a service, customized product, or other item that falls outside that definition. The COTS question drives the exemption under DFARS 252.204-7012 and FAR 52.204-21. The output is a classification field on each subcontract line, supported by the supplier's description of the item and any catalog or commercial listing the prime relies on.
Decide whether the supplier's own systems handle CUI
Even when the item is COTS, the prime asks whether the supplier will use its own information systems to process, store or transmit CUI during performance, such as a support portal, ticketing system, or engineering repository that receives controlled data. The COTS exemption covers the delivery of the product, not the supplier's use of its systems for the contract. The output is a written determination for each subcontract, signed off by the prime's contracts or security lead.
Insert clause substance and any CMMC requirement
Where the subcontract involves FCI or CUI and is not solely for COTS items, the prime places the substance of DFARS 252.204-7012 and FAR 52.204-21 into the subcontract, along with the CMMC level requirement and clause 252.204-7021 where the contract requires it. Where the item is COTS and the supplier's systems will not handle controlled data, the prime generally does not flow these clauses down. The output is the executed subcontract clause set, which names the requirements the supplier must meet.
Obtain written confirmation of the supplier's status
The supplier should ask the prime for a written statement of its status for each order, covering whether the item is treated as COTS, whether any CUI will reside on its systems, and which clauses apply. The supplier can answer the prime's supplier questionnaire with the same facts, including how it stores and transmits any controlled data it receives. The prime owns the flowdown decision, so the supplier's written record is the reference point if the status changes. The output is a signed status letter or questionnaire answer kept in the supplier's contract file.
What the 2028 clause date means for COTS suppliers
The 2028 date changes when DFARS 252.204-7021 reaches your contracts, not whether COTS items are exempt. Under the DFARS deviation, until 9 November 2028 the clause goes into a contract only when the program office or requiring activity specifies a CMMC level. From 10 November 2028 it applies whenever contractor systems will process, store or transmit FCI or CUI, and it still excludes contracts solely for COTS items. For a supplier that only ships COTS products, the exemption holds on either date. For a supplier that handles CUI in its own systems, the earlier schedule means some contracts will carry the clause only if the requiring activity says so, and the later schedule means it will appear by default. Plan your evidence program for the later date even if your current contracts do not name a level.
The current status is less settled than the rule text suggests. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts, and it opened a 60-day review by a CMMC Reform Task Force. The DoW CIO's About CMMC page stated on 17 October 2026 that implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, so the regulation and the policy notice disagree. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place regardless of the suspension.
Confirm the status in writing before you make staffing or certification decisions. Ask the contracting officer on each solicitation whether the requiring activity has specified a CMMC level and which DFARS clauses apply, and check the DoW CIO page for any change after the date of your review. Document the answers in your contract file. If your COTS sales are the only defense work you do, keep the COTS determination on record, and revisit it whenever a buyer asks you to host, process or transmit CUI in a system you operate.
What a COTS supplier should check before a prime asks
A COTS exemption covers the product sale, not the supplier's own systems. The cards below cover what the organization should inventory, confirm and document before a prime or contracting officer asks, and where outside help fits without changing who owns the controls or the evidence.
Inventory every system that could touch CUI
Start with a complete list of information systems, cloud tenants, email, file shares, collaboration tools and laptops that could hold, process or transmit controlled unclassified information or federal contract information. Include systems used for support tickets and engineering data exchange, since these are often missed. The organization owns this inventory and must keep it current. An implementation partner can help map the systems, but the organization confirms which ones are in scope for its contracts.
Confirm which products are truly COTS
The COTS exemption depends on the definition in FAR 2.101, so each item sold under a DoD contract should be checked against that definition rather than against marketing labels. Products modified for government use or sold with custom development may fall outside it. The organization makes this determination and should record the reasoning for each product family. Legal or contracts staff, not a technical partner, should sign off on the classification.
Document where CUI enters and leaves
Draw the data flow for each contract that involves CUI: how it arrives, where it is stored, which people and systems process it, and where copies leave the organization, including to subcontractors, cloud services and shipping partners. Gaps here are a common reason a supplier discovers it is inside scope late. The organization owns the data flow record. A partner can help document flows and check them against system inventories, but cannot confirm them without the organization's input.
Confirm the CMMC level and clause per contract
Read each solicitation and contract for the clause that applies and the CMMC level the program office or requiring activity has specified. Under the current schedule, clause 252.204-7021 does not appear in every contract, so the level is not implied by the mere presence of DFARS 7012. Record the clause version, level and flowdown requirements in a contract register. The organization owns this review. Contracts staff should confirm the terms directly with the prime or contracting officer when they are unclear.
Collect Phase I self-assessment and SPRS posture
If the organization holds work that requires Level 2, gather the self-assessment record, the score posted to SPRS, the system security plan and any plans of action and milestones. Confirm that the evidence reflects final, not draft, documentation. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place after the suspension of Phase II. The organization owns the score and its accuracy. An independent assessor is needed only where a contract requires a certification assessment.
Assign an owner for affirmations
Under the CMMC rule, an senior official must affirm continuing compliance, and the affirmation must be accurate when given. Name one accountable person and a backup, define what they review before signing, and set a schedule for re-review after system changes. The affirming official is an organizational role and cannot be delegated to an outside partner or assessor. Partners can prepare the evidence the official reviews, but the official's judgment and signature stay with the company.
Common questions from COTS suppliers and primes
If we only sell COTS products, do we have no CMMC work to do?
Usually not for the sale itself, but the answer depends on how you use those products. The CMMC rule says its requirements do not apply to contracts and subcontracts that exclusively deliver COTS products to a DoD buyer, and DFARS 252.204-7012 and FAR 52.204-21 carry the same COTS carve-out. That exemption covers the delivery. It does not cover your own company. If your staff store, process or transmit CUI or Federal contract information on systems you run, those systems must meet the applicable requirements, whatever products they are built from. Confirm with your contracting officer or prime which contracts are truly COTS-only, and document how each one was classified.
Does a COTS email or file sharing tool count as in scope?
It can, if your organization uses it to handle CUI or Federal contract information. The COTS exemption describes the product you deliver to the government, not the tools your staff use to do the work. A commercial email platform, file share or collaboration suite that holds CUI is part of your environment and must be assessed within your scope. The practical questions are whether the tool stores or transmits CUI, which accounts reach it, how it is configured, and whether the vendor's own authorization or contract terms meet the requirements you must show. Ask your assessor early whether a given tool belongs inside the boundary, and keep a written decision for each one.
How does the COTS exemption apply to support and maintenance work?
Support and maintenance are not automatically covered by the COTS exemption, because the exemption is tied to contracts that exclusively deliver COTS products. If a support contract involves access to systems holding CUI, remote troubleshooting, data handling or custom work, the contract is likely to fall outside the carve-out. Review the statement of work for three things: whether the work touches CUI or FCI, whether the contractor's systems will hold that information, and whether the service is a commercial product or a separate service. Each answer changes the flowdown obligations. Get that classification in writing before work begins.
Can a prime require CMMC from a COTS supplier?
A prime cannot push the clause into a subcontract that is exclusively COTS, because DFARS 252.204-7021 excludes COTS items from its flowdown. The prime must flow the clause down when the subcontract involves processing, storing or transmitting FCI or CUI. So the trigger is the work, not the supplier's label. A supplier that sells a COTS item with no access to CUI should not face the requirement, while a supplier with a support or hosting role that touches CUI can. Ask the prime to state in writing which subcontract terms apply and why, and check the clause text rather than relying on a summary.
What does the 2028 date change for COTS suppliers?
The date matters mainly for contracts that include the clause. According to the DFARS deviation's schedule, until 9 November 2028, clause 252.204-7021 enters contracts only when the program office or requiring activity specifies a CMMC level. From 10 November 2028, it applies whenever contractor systems will process, store or transmit FCI or CUI, with the exception of contracts solely for COTS items. The COTS exception therefore stays in place after 2028. Your exposure comes from your own systems and any non-COTS work you take on. Check the current status of CMMC phases with the Department of War, since the schedule has changed.
Can we do the CMMC scoping ourselves?
Yes, for a first pass, and many organizations do. Scoping is the process of listing every system, person and service that will process, store or transmit CUI or FCI, plus the systems that can affect their security. The organization owns that decision and must make it. Internal staff know the data flows best, but an outside reviewer often finds systems that were overlooked, such as shared accounts, backups or support tools. An independent assessor will judge the final boundary, so document your reasoning. DeployOpen can prepare systems and evidence for a scope you define, but the scope decision and its record remain with your organization.
How long does COTS scoping take?
No supplied fact gives a duration for scoping, so confirm the timing with your advisers rather than relying on a number here. The effort depends on how many systems touch CUI, how well your data flows are documented, how many contracts need individual classification, and how many subcontractors and cloud services are involved. Ask any consultant or provider for a written scope with the systems covered, the deliverables and a timeline agreed before work starts. Ask your prime or contracting officer whether they need a classification memo for each contract, since that can add time.
What drives the cost of COTS scoping and compliance work?
The main cost drivers are the number of systems and tools in the boundary, the number of contracts that need individual classification, the state of your existing documentation, and whether you need outside help. Costs split into one-time work, such as classification, scoping, gap remediation and evidence preparation, and recurring work, such as periodic reviews, affirmations and updated records. Costs can also come from the assessment itself, which only an independent assessor performs. DeployOpen does not publish prices. Ask any provider for a quote that lists the systems in scope, the deliverables, who performs each task, and which recurring items are included.
Who issues the CMMC certificate or assessment report?
Only an independent assessor issues a CMMC assessment result or certificate. Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, and Level 3 certification assessments are performed by DCMA DIBCAC. Your organization owns its controls and its self-assessment record, and it submits its affirmations. An implementation partner such as DeployOpen prepares systems, controls and evidence, but it does not issue reports or certificates. Check the current status of certification requirements, because the Department of War has suspended Phase II.
How DeployOpen scopes COTS and CUI boundaries for suppliers
DeployOpen helps suppliers draw the line between COTS products delivered to a buyer and the systems that process CUI in their own environment. We plan, build and document the self-hosted open-source platforms inside the client's own infrastructure, then prepare the evidence. Only an independent assessor issues results.
How we scope
- Separate contracts that only deliver COTS items from work where your own systems hold CUI.
- Map every internal system that processes, stores or transmits CUI, including COTS software you run inside it.
- Agree the boundary and deliverables in a written, fixed-scope statement before any work starts.
- Confirm with your contracting officer or prime which clause level applies to each contract.
How we build
- Deploy self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- Configure access control, audit logging, encryption and configuration baselines against the Level 2 requirements.
- Test the boundary and controls, then record the results and any open gaps for remediation.
- Keep COTS tools outside the CUI boundary where the contract allows, and document why each one sits where it does.
How we hand over
- Deliver a system security plan, network diagram and data flow map that match the agreed boundary.
- Provide evidence packages mapped to each Level 2 requirement, ready for an assessor to review.
- Train your staff to run the platforms, update the evidence and explain the boundary to primes and assessors.
- Document a flowdown approach that shows primes which subcontracts carry the clause and why.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover.
- Re-check the boundary when COTS products change, new subcontractors join or contract clauses are updated.
- Confirm current CMMC status, phase requirements and clause dates with the Department of War or your prime before each change.
- Coordinate with your independent assessor or certification body, which alone issues reports or certificates.
