The challenges of providing assurance evidence for COTS and reused components

COTS and reused components carry the same certification evidence burden as for software developed specifically for the system. Process-based certification evidence is very difficult to gather when the development is outside your control (and may have already completed). The paper considers how much credible evidence can be obtained by inspection and gathered retrospectively, how much system level testing is required, and how much reliance can be placed on service history.