National Security Agency / Central Security Service - Top Banner

Commercial Solutions for Classified Intake Process

The NSA's Commercial Solutions for Classified (CSFC) Process has been established to enable the use of layered Commercial Off-The-Shelf (COTS) products to protect national security systems and their classified data. Under the CSFC program, NSA enters into an agreement with a vendor to evaluate and list commercial products as available for use in the CSFC program.

NSA applies its IA resources to evaluate whether those NSTISSP No. 11 (or its successor) compliant commercial products provide for quality, inexpensive, secure communications systems for use by U.S. Government entities. Interested vendors must complete a CSFC Questionnaire.

What is the process to get a product listed?

Vendors will:

• Complete and submit the CSFC Questionnaire (PDF) for each product

NSA will:

1. Verify that your product is complaint with NSTISSP No. 11
2. Enter a CSFC Memorandum of Agreement (MOA) with your company
3. Conduct a targeted vulnerability analysis
4. Add the product to the CSFC Components List once the product has met all the requirements