The best control to mitigate the risk of using a Commercial Off-The-Shelf (COTS) solution is to deploy the application with a hardened configuration. A COTS solution is a type of software or hardware product that is ready-made, standardized, and available for purchase from a vendor or a third party, without requiring any customization or modification by the customer or the user. A COTS solution can pose a security risk, as it may contain security vulnerabilities or issues that can be exploited by the attackers, or that may not comply with the security policies and standards of the organization. A hardened configuration is a type of security control that involves applying the security best practices and guidelines to configure the COTS solution, such as disabling or removing the unnecessary features, functions, or services, updating or patching the software or firmware, or enforcing the security settings or parameters. A hardened configuration can mitigate the risk of using a COTS solution, by reducing the attack surface and exposure of the COTS solution, and by enhancing the security, performance, and reliability of the COTS solution . References: [CISSP CBK, Fifth Edition, Chapter 3, page
239]; [CISSP Practice Exam - FREE 20 Questions and Answers, Question 15].