<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita>
   <concept id="DFARS_212.371" class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">212.371</ph> 
       Inapplicability of certain provisions and clauses to contracts for the acquisition of commercially available off-the-shelf items.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">Commercially available off-the-shelf (COTS) items are a subset of commercial products. Therefore, the provisions and clauses listed in <xref href="212.370.dita#DFARS_212.370"
                  outputclass="fm:ParaNumOnly"
                  class="- topic/xref ">212.370</xref> as not applicable to contracts or subcontracts for the acquisition of commercial products are also not applicable to contracts or subcontracts for the acquisition of COTS items. In addition, the following provisions and clauses published after October 13, 1994, not expressly authorized in law, are not applicable or are modified in their applicability to contracts for the acquisition of COTS items:</p>
         <p outputclass="List1" class="- topic/p "> (a) FAR <xref scope="external"
                  format="html"
                  href="https://www.acquisition.gov/far/52.204-21"
                  class="- topic/xref ">52.204-21</xref>, Basic Safeguarding of Covered Contractor Information Systems.</p>
         <p outputclass="List1" class="- topic/p ">(b) 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls.</p>
         <p outputclass="List1" class="- topic/p ">(c) 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. </p>
         <p outputclass="List1" class="- topic/p ">(d) 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements. </p>
         <p outputclass="List1" class="- topic/p ">(e) 252.204-7020, NIST SP 800-171 DoD Assessment Requirements. </p>
         <p outputclass="List1" class="- topic/p ">(f) 252.204-7021, Cybersecurity Maturity Model Certification Requirements. </p>
         <p outputclass="List1" class="- topic/p ">(g) 252.205-7000, Provision of Information to Cooperative Agreement Holders.</p>
         <p outputclass="List1" class="- topic/p ">(h) 252.270-7000, Pilot Program to Incentivize Contracting with Employee-Owned Businesses—Representation. </p>
         <p outputclass="List1" class="- topic/p ">(i) 252.270-7001, Pilot Program to Incentivize Contracting with Employee-Owned Businesses—Subcontracting Certification. </p>
         <p outputclass="List1" class="- topic/p ">(j) 252.270-7002, Pilot Program to Incentivize Contracting with Employee-Owned Businesses. </p>
      </conbody>
   </concept>
</dita>
