GOTS vs. COTS in Classified Solutions: Choosing and Integrating the Right Mix

For decades, protecting classified information meant using government-developed equipment almost exclusively. Today, classified solutions routinely combine government off-the-shelf (GOTS) and commercial off-the-shelf (COTS) technology. Commercial products bring speed, capability and cost advantages; government products bring assurance levels designed specifically for classified missions.

Choosing the right mix, and integrating it into a system that can be accredited, is a core engineering challenge.

GOTS: built for the mission

GOTS products are developed for or owned by the government. In classified environments, the best-known examples are NSA-certified Type 1 encryption devices, which protect classified information in transit. Other GOTS components include specialized cross-domain solutions, government-developed software and mission applications.

Strengths: assurance designed for classified threats, established approval paths and long operational histories.

Considerations: controlled acquisition and handling, cryptographic keying requirements, longer procurement and upgrade cycles, and sometimes limited features compared with commercial equivalents.

COTS: speed and capability

COTS products are commercially available hardware and software: servers, network equipment, operating systems, virtualization platforms, security tools and more. Nearly every classified network relies on COTS for its underlying infrastructure.

COTS can also protect classified information directly. NSA's Commercial Solutions for Classified (CSfC) program allows layered commercial encryption products, used in approved architectures called capability packages, to protect classified data. Components are typically selected from lists of products evaluated against NIAP Protection Profiles.

Strengths: faster acquisition, frequent updates, scalability, modern features and broad vendor support.

Considerations: products must be selected carefully and configured exactly as the approved architecture requires; supply chain risk must be managed; and frequent updates must be tested and controlled.

Where each tends to fit

There is no universal rule, but common patterns emerge:

• High-assurance encryption for classified links is often GOTS Type 1, while CSfC offers a commercial alternative in approved use cases, such as mobile access and some campus and site-to-site scenarios.
• Core infrastructure, including servers, storage, switching and virtualization, is almost always COTS, hardened to DISA STIGs.
• Cross-domain transfers use solutions from government-maintained baseline lists.
• Security tooling, including endpoint protection, logging and scanning, is typically COTS, approved for use in the environment.
• Mission applications may be GOTS, COTS or custom, depending on the program.

Integration is where the risk lives

Individual products may each be approved and well understood. Problems appear when they are combined:

• Configuration requirements conflict. A product's approved configuration may clash with another product's needs or with a STIG.
• Interfaces are fragile. Authentication, key management and logging between GOTS and COTS components often require careful engineering.
• Update cycles differ. Commercial products may update monthly; government products may update rarely. Keeping versions compatible and approved takes planning.
• Documentation must cover the whole. Assessors evaluate the integrated system, including data flows, boundaries and dependencies, not only product approvals.

Supply chain considerations

COTS products introduce supply chain questions: where the product was built, how it was delivered, and whether its firmware and software can be trusted. Programs should:

• buy through trusted channels
• verify product authenticity and integrity on receipt
• track firmware and software versions
• follow program protection and supply chain risk management requirements

Getting to accreditation

Accreditation depends on the entire system: design, component selection, configuration, documentation and sustainment plan. Practical advice:

1. Start from approved patterns. Use established architectures, such as CSfC capability packages, where they fit the mission.
2. Engage the authorizing official early. Confirm that the proposed mix is acceptable before buying equipment.
3. Document decisions. Record why each component was chosen and how it meets requirements.
4. Build and test in a representative environment. Integration issues are cheaper to find before installation at the operational site.
5. Plan sustainment for both worlds. Define how COTS updates and GOTS changes will be tested, approved and deployed.

An illustrative scenario

A program needs to give analysts at a small forward site access to classified applications hosted at a main facility, over commercial network links.

One design uses GOTS Type 1 encryptors at each end, with the site's local network built from STIG-hardened COTS switches, servers and workstations. The encryptors require keying material, trained custodians and controlled handling, but the approach is well established.

Another design, where the use case fits an approved capability package, uses two independent layers of commercial encryption from products on the approved component list, configured exactly as the capability package requires. Acquisition is faster and hardware is easier to replace, but configuration, key management and monitoring must follow the capability package precisely, and the solution must be registered and approved.

Either design can work. The right choice depends on the mission, timelines, sustainment capacity and what the authorizing official will accept. Making that decision early, with the authorizing official involved, prevents buying equipment that cannot be accredited.

Questions to settle early

• What classification level and data types will the solution handle?
• Which approved architectures or patterns fit the mission?
• Who will manage keys and cryptographic equipment?
• How will commercial updates be tested and approved?
• What will the authorizing official need to see?

How CDT can help

CDT's classified solutions design, integration, implementation and accreditation services bring GOTS and COTS together into systems that serve the mission and pass accreditation, with one team accountable from design through ATO. See also classified network engineering and CipherX.

Sources

• NSA Commercial Solutions for Classified (CSfC)
• National Information Assurance Partnership (NIAP)