A Technical History of the SEI

Developing Systems with Commercial Off-the-Shelf Products
The Challenge: Using Commercial Off-the-Shelf Products in Defense
Systems
Incorporating commercial components 57 into new systems has long been an effective means to
save time and money in building large software systems. In 1986, the Packard Commission urged
the DoD to “develop new or custom-made items only when it has been established that those
readily available are clearly inadequate to meet military requirements” [Packard 1986]. In 1994,
the DoD was similarly urged to use commercial off-the-shelf (COTS) products by a Defense Science
Board Report, Acquiring Defense Software Commercially [DSB 1994]. There was early DoD
concern about how COTS products could meet the rigid military security and performance requirements,
and the DoD took initial steps toward the use of these products by establishing several
initiatives. For example, the Navy conducted the NGCR program to identify interface standards
for operating systems, networks, and several other areas as a step toward open systems,
which, in turn, encouraged the development and use of COTS products.
At that time, there was substantial movement toward using COTS operating systems, but introducing
the use of COTS products at the level described above proved to be challenging—and was
accompanied by an increase in program failures. The increased use of COTS products meant that
developers lost design control, which was now influenced by market forces. Competitive pressures
in the software marketplace motivated vendors to innovate and differentiate features rather
than to stabilize and standardize, making component integration difficult and increasing design
complexity. Knowledge obtained about one commercial software component did not translate easily
from one vendor to another and tended to degrade quickly as the products evolved through
new releases. Because integrating COTS products proved to be a delicate and difficult task, specific
engineering practices were needed to accomplish that task successfully [Wallnau 2001].
A Solution: Tools and Guidance for Improved Use of COTS Products
When the significant need in the COTS area became apparent, the SEI was poised to provide
much-needed expertise. The SEI’s CASE (computer-aided software engineering) Environments
work provided a strong foundation, and the SEI staff had a breadth of related experience that
could be brought to bear. In 1997, the COTS-Based Systems (CBS) initiative was created. In a
typical SEI approach, the initiative developed basic principles as a foundation, and developed processes,
tools, and methods for acquiring, engineering, and managing COTS-based systems. The
SEI emphasized the convergence in four spheres needed for success: stakeholder needs and business
processes; system architecture and design; the marketplace; and management processes, concerns,
and constraints that govern the development of the system, including risk management. The
keys to success from this perspective are iterative negotiation and knowledge building among
these spheres, improving the basis for making decisions. The SEI worked directly with several
government programs (for example, the Business Information System Program Office, Electronic
57 Examples of commercial components range from platform-level (such as HTTP servers and transaction
monitors) to general purpose (such as web browsers and relational database management
systems) to domain specific (such as tax preparation packages, geographic information systems,
and biometric identity products).
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 221
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.