Medical device
In the medical device industry, COTS software can sometimes be identified as SOUP (software of unknown pedigree or software of unknown provenance), i.e., software that has not been developed with a known software development process or methodology, which precludes its use in medical devices. In this industry, faults in software components could become system failures in the device itself if the steps are not taken to ensure fair and safe standards are complied with. The standard IEC 62304:2006 "Medical device software – Software life cycle processes" outlines specific practices to ensure that SOUP components support the safety requirements for the device being developed. In the case where the software components are COTS, DHS best practices for COTS software risk review can be applied. Simply being COTS software does not necessarily imply the lack of a fault history or transparent software development process. For well documented COTS software a distinction as "clear" SOUP is made, meaning that it may be used in medical devices.