In my experience, gov't wants to minimise (what they perceive, myopically, as) risk and always insist on 'COTS' (Commercial Off The Shelf) systems... so vendors like SAP, Oracle, et al. sell "COTS" which requires substantial 'customisation', which is really just code. Lots of it. From a small selection of 'authorized' configurers, who cost a bomb... so it's bespoke, but gov't thinks it's bought COTS. Ugh.