More and more organizations are realizing the benefits-and sometimes the necessity-of incorporating commercial off-the-shelf (COTS) products in the systems they acquire and use. But COTS products are not necessarily the right solution for every system. When is it wise to pursue a COTS-based systems approach, and when is it best to hold back? How can sound COTS-based-system practices be reconciled with an organization's regulatory and policy constraints? This report provides some information to help guide these decisions