More and more software projects use commercial-off-the-shelf (COTS) components. Although previous studies have proposed specific COTS-based development processes, there are few empirical studies to investigate how to use and customize them to different project contexts. This paper describes an exploratory study of state-of-the-practice of COTS-based development processes. 16 software projects in Norwegian IT companies have been studied by structured interviews. The results are that COTS-specific activities can be successfully incorporated in most traditional development processes (such as waterfall or prototyping), given proper guidelines to reduce risks and provide specific assistance. We have identified four COTS-specific activities - the build vs. buy decision, COTS component selection, learning and understanding COTS components, and COTS component integration - and one new role, that of a knowledge keeper. We have also found a special COTS component selection activity for unfamiliar components, combining Internet searches with hands-on trials. The process guidelines are expressed as scenarios and lessons learned, and can be used to customize the actual development processes, e.g. in which lifecycle phase to put the new activities. Such customization crucially depends on project context, such as previous familiarity with possible COTS components and flexibility of requirements.