Commercially available off-the-shelf (COTS) items are a subset of commercial products. Therefore, the provisions and clauses listed in 212.370 as not applicable to contracts or subcontracts for the acquisition of commercial products are also not applicable to contracts or subcontracts for the acquisition of COTS items. In addition, the following provisions and clauses published after October 13, 1994, not expressly authorized in law, are not applicable or are modified in their applicability to contracts for the acquisition of COTS items:

(a) FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.

(b) 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls.

(c) 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

(d) 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements.

(e) 252.204-7020, NIST SP 800-171 DoD Assessment Requirements.

(f) 252.204-7021, Cybersecurity Maturity Model Certification Requirements.

(g) 252.205-7000, Provision of Information to Cooperative Agreement Holders.

(h) 252.270-7000, Pilot Program to Incentivize Contracting with Employee-Owned Businesses—Representation.

(i) 252.270-7001, Pilot Program to Incentivize Contracting with Employee-Owned Businesses—Subcontracting Certification.

(j) 252.270-7002, Pilot Program to Incentivize Contracting with Employee-Owned Businesses.