The Orange Book (DoD 5200.28-STD, “Trusted Computer System Evaluation Criteria”) groups systems into four major divisions. Division B is explicitly named “Mandatory Protection.” Classes B1-B3 introduce and require mandatory access control and labeling enforced by the Trusted Computing Base (TCB). Division C (“Discretionary Protection”) and Division D (“Minimal Protection”) do not impose mandatory mechanisms, while Division A (“Verified Protection”) focuses on formal verification of the design; its defining attribute is verification rather than the initial introduction of mandatory TCB protection. Hence, the division characterized by mandatory TCB protection is the B-rated class.

A. C-rated – Provides only discretionary access control; no mandatory mechanisms required.

C. D-rated – Minimal/no protection; systems fail to satisfy higher criteria.

D. A-rated – Adds formal verification to B-level controls; division’s hallmark is “verified,” not the introduction of mandatory protection.

1. DoD 5200.28-STD

“Trusted Computer System Evaluation Criteria

” 1985

Sec. 6

p. 29-32: “Class B – Mandatory Protection” (defines B1–B3 and mandatory TCB enforcement).

2. NIST SP 800-12 Rev.1

“An Introduction to Computer Security

” 2020

§5.2

p. 5-4: Table summarizing Orange Book classes (B = Mandatory Protection).

3. Bishop

M. “Computer Security: Art and Science

” Addison-Wesley

2nd ed.

2019

Ch. 25

p. 1122-1123: discussion of TCSEC divisions and mandatory controls beginning at B1.

4. Stanford CS155 “Computer and Network Security” Lecture Notes

2022

Slide set on Evaluation Criteria

slide 11: Orange Book overview (B-class = Mandatory Protection).