https://cmmcinfo.org/cmmc-faq/applicability/what-is-commercially-available-off-the-shelf-cots/