The Orange Book (DoD 5200.28-STD, “Trusted Computer System Evaluation Criteria”) groups systems into four major divisions. Division B is explicitly named “Mandatory Protection.” Classes B1-B3 introduce and require mandatory access control and labeling enforced by the Trusted Computing Base (TCB). Division C (“Discretionary Protection”) and Division D (“Minimal Protection”) do not impose mandatory mechanisms, while Division A (“Verified Protection”) focuses on formal verification of the design; its defining attribute is verification rather than the initial introduction of mandatory TCB protection. Hence, the division characterized by mandatory TCB protection is the B-rated class.

A. C-rated – Provides only discretionary access control; no mandatory mechanisms required.

C. D-rated – Minimal/no protection; systems fail to satisfy higher criteria.

D. A-rated – Adds formal verification to B-level controls; division’s hallmark is “verified,” not the introduction of mandatory protection.

1. DoD 5200.28-STD

“Trusted Computer System Evaluation Criteria

” 1985

Sec. 6

p. 29-32: “Class B – Mandatory Protection” (defines B1–B3 and mandatory TCB enforcement).

2. NIST SP 800-12 Rev.1

“An Introduction to Computer Security

” 2020

§5.2

p. 5-4: Table summarizing Orange Book classes (B = Mandatory Protection).

3. Bishop

M. “Computer Security: Art and Science

” Addison-Wesley

2nd ed.

2019

Ch. 25

p. 1122-1123: discussion of TCSEC divisions and mandatory controls beginning at B1.

4. Stanford CS155 “Computer and Network Security” Lecture Notes

2022

Slide set on Evaluation Criteria

slide 11: Orange Book overview (B-class = Mandatory Protection).

The question provides the textbook definition of Project Scope Management. This fundamental project management process involves defining and controlling what is and is not included in a project. The primary goal is to ensure that the project team performs all the work required, and only the work required, to achieve the project's objectives successfully. Estimating and defining the project scope is the specific task that establishes these boundaries, preventing "scope creep" and ensuring resources are focused on delivering the agreed-upon outcomes.

A. Identify Roles and Responsibilities: This task is part of project resource management, focusing on assigning authority and tasks to team members, not defining the work itself.

B. Develop Project Schedule: This task belongs to project schedule management, which concentrates on the timeline, sequencing, and duration of project activities.

C. Identify Resources and Availability: This is a component of project resource management, concerned with acquiring the necessary personnel, equipment, and materials to perform the work.

1. Project Management Institute. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) (6th ed.). The introduction to Chapter 5

"Project Scope Management

" states

"Project Scope Management includes the processes required to ensure that the project includes all the work required

and only the work required

to complete the project successfully." (p. 129).

2. Ross

R.

McEvilley

M.

& Oren

J. (2018). Systems Security Engineering: An Integrated Approach to Building Trustworthy Resilient Systems (NIST Special Publication 800-160

Vol. 1). National Institute of Standards and Technology. Section 2.3.3 discusses the importance of project planning

which includes defining the scope of engineering activities within the system life cycle to ensure security requirements are adequately addressed.

3. MIT OpenCourseWare. (2006). 16.852J / ESD.34J Integrating the Lean Enterprise

Fall 2006. Massachusetts Institute of Technology. Lecture 3 notes on "Project Management" define the project scope as one of the three critical constraints (along with time and cost)

emphasizing it as the definition of the work to be accomplished.

Risk response strategies are tailored to whether the risk is negative (a threat) or positive (an opportunity). For negative risks, the primary responses are to avoid, transfer, mitigate, or accept the risk. Acceptance is a valid strategy where an organization decides to acknowledge a risk and not take any action unless the risk occurs, having concluded that the cost of other responses outweighs the potential loss. The other options listed—Enhance, Share, and Exploit—are strategies for responding to positive risks (opportunities), not negative ones.

B. Enhance: This response is used for positive risks (opportunities) to increase the probability and/or impact of the event occurring.

C. Share: This is a strategy for positive risks, involving allocating ownership to a third party best able to capture the opportunity's benefit. The counterpart for negative risks is "Transfer."

D. Exploit: This strategy is for positive risks and involves taking actions to ensure that the opportunity is fully realized.

1. NIST Special Publication 800-30 Revision 1

Guide for Conducting Risk Assessments. Section 3.3

"Risk Response

" page 29

identifies "Risk acceptance" as a fundamental response strategy. It states

"The appropriate level of management can formally accept the risk and

in doing so

agrees to incur the costs associated with the potential materialization of the risk."

2. Project Management Institute (PMI)

A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Section 11.5.2.4

"Strategies for Negative Risks or Threats

" lists Avoid

Transfer

Mitigate

and Accept. Section 11.5.2.5

"Strategies for Positive Risks or Opportunities

" lists Exploit

Enhance

Share

and Accept. This framework is a foundational element of risk management taught in university-level project and engineering management courses.

3. University of Maryland

Project Management Center for Excellence

Course: ENCE627 - Risk Management. The course syllabus and materials outline risk response planning

explicitly differentiating strategies for threats (Avoid

Transfer

Mitigate

Accept) from those for opportunities (Exploit

Enhance

Share

Accept)

confirming the distinct application of these terms.

DoD 7950.1-M is the correct designation for the "Defense Automation Resources Management Manual." This manual provided policies and procedures for the management, administration, and use of the Department of Defense's automated information systems (AIS) and resources. Although this specific manual is an older publication and has been superseded by newer directives within the DoD 8000 series, it established foundational principles for managing automation resources, which is a key historical concept within the ISSEP domain. The question tests knowledge of historical DoD documentation that shaped current information systems security and management policies.

A. DoD 8910.1: This directive pertains to the Management and Control of Information Requirements, focusing on data collection and reporting, not the management of automation resources.

C. DoD 5200.22-M: This is the National Industrial Security Program Operating Manual (NISPOM), which provides security requirements for government contractors handling classified information.

D. DoD 5200.1-R: This was the Information Security Program Regulation, which established the primary security program for classifying, marking, and handling classified DoD information.

E. DoDD 8000.1: This is a high-level directive concerning the "Management of the Department of Defense Information Enterprise," a much broader and more modern scope than the specific manual in question.

1. U.S. General Accounting Office. (1987). ADP ACQUISITION: FAA's Advanced Automation System Acquisition Is Risky (Report No. GAO/IMTEC-88-2). Retrieved from the GAO website. This official government report explicitly references "DOD Manual 7950.1-M

Defense Automation Resources Management Manual" on page 20.

2. Department of Defense. (2002). DoD Directive 8000.1: Management of the Department of Defense Information Enterprise. Washington Headquarters Services. Retrieved from the official DoD Issuances website. This document defines the scope of the modern DoD Information Enterprise

distinguishing it from older

more specific manuals like 7950.1-M.

3. Department of Defense. (1995). DoD 5200.22-M: National Industrial Security Program Operating Manual (NISPOM). This document's title and purpose are well-established in government and academic sources covering industrial security.

4. Department of Defense. (1997). DoD 5200.1-R: Information Security Program Regulation. This historical document is widely cited in literature concerning the handling of classified national security information.

5. Department of Defense. (1993). DoD 8910.1-M: DoD Procedures for Management of Information Requirements. Washington Headquarters Services. This document

now canceled

is listed on the official DoD Issuances website

confirming its distinct purpose related to information requirements management.

The DoD Information Technology Security Certification and Accreditation Process (DITSCAP) is a standardized, four-phase methodology. The process begins with Phase 1: Definition, where the system's mission, architecture, and security requirements are documented in the System Security Authorization Agreement (SSAA). This is followed by Phase 2: Verification, where the system's design and development are checked for compliance with the SSAA. Phase 3: Validation involves testing the fully integrated system to confirm it meets the documented security requirements, leading to a certification determination. Finally, Phase 4: Post Accreditation involves the ongoing monitoring and management of the accredited system's security posture throughout its operational lifecycle.

A. This option incorrectly places Validation before Verification. Verification of system compliance occurs during development, before the final validation of the integrated system.

B. This option incorrectly starts with Verification. The process must begin with the Definition phase to establish the security requirements and operational context.

C. This option incorrectly starts with Verification and reverses the order of other phases. The Definition phase is the foundational first step.

1. U.S. Department of Defense. (1997

December 30). DoD Instruction 5200.40: DoD Information Technology Security Certification and Accreditation Process (DITSCAP). Section E2.1.2. This instruction officially defines the four phases and their sequence: "The DITSCAP is a dynamic and iterative process that consists of four phases: Phase 1

Definition; Phase 2

Verification; Phase 3

Validation; and Phase 4

Post Accreditation."

2. Wilson

R. L. (2002). A Comparison of the new DoD C&A processes: DITSCAP and NIACAP. SANS Institute InfoSec Reading Room. Page 5. The paper outlines the DITSCAP lifecycle

stating

"The DITSCAP is a four-phased process. The phases are Definition

Verification

Validation

and Post Accreditation."

3. Naval Postgraduate School. (n.d.). CS3670: Secure Computer Systems

Lecture 10 - Certification and Accreditation. Courseware slides describe the DITSCAP process

explicitly listing the phases in the correct order: 1. Definition

2. Verification

3. Validation

4. Post Accreditation.

Functional Analysis is a core process in systems engineering used to translate and decompose high-level system requirements into a set of detailed, lower-level functions. This systematic process identifies what the system must do to meet the stakeholder needs defined in the requirements. It involves breaking down complex functions into simpler, manageable sub-functions until they are detailed enough to be assigned to specific system components (hardware, software, or personnel). The output, often called a functional architecture or detailed function criteria, serves as a crucial input for the subsequent design and implementation phases, ensuring that all initial requirements are met by the final system.

1. National Institute of Standards and Technology (NIST). (2018). Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (NIST Special Publication 800-160

Vol. 1).

Section 3.2.2

System Requirements Definition Process: This section describes the process of transforming "the stakeholder

user-oriented view of desired services

capabilities

and conditions into a technical view of a required system." This transformation is the essence of functional analysis

which derives the functional criteria from the initial requirements.

2. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2005). 16.885J Aircraft Systems Engineering

Lecture 5: Functional Analysis and Decomposition.

Slide 3: The lecture notes explicitly state

"Functional analysis is the process of translating system requirements into a detailed description of the functions that the system will have to perform." This directly corresponds to the question's definition.

3. National Aeronautics and Space Administration (NASA). (2016). NASA Systems Engineering Handbook (NASA/SP-2016-6105 Rev 2).

Section 4.3

Technical Requirements Definition: This section details the process of deriving and decomposing parent requirements into a more detailed set of technical requirements. It states

"The set of derived technical requirements results from the analysis of the required behavior of the system (functional analysis)..." This confirms that functional analysis is the method used to create detailed criteria from initial requirements.

The Decision Analysis section of the Systems Engineering Management Plan (SEMP) outlines the structured process for making technical decisions. This process involves conducting formal trade studies to evaluate alternatives against established criteria, which include functionality, performance, cost, schedule, and risk. The goal is to provide a transparent, repeatable, and defensible basis for selecting the most suitable option among competing alternatives. This ensures that all key stakeholder concerns are balanced and the final decision aligns with the overall project objectives and constraints.

1. NASA. (2016). NASA Systems Engineering Handbook (NASA/SP-2016-6105 Rev 2).

Reference: Appendix C

Section 4.3

"Decision Analysis Process

" page 268. It states

"This section of the SEMP describes the project’s decision analysis process... The process should cover how formal trade studies are conducted

documented

and used in the decision-making process."

2. International Organization for Standardization. (2015). ISO/IEC/IEEE 15288:2015 Systems and software engineering — System life cycle processes.

Reference: Section 6.3.3

"Decision management process." The purpose of this process is "to provide a basis for decisions by evaluating alternatives against established criteria." This process is what is documented in the SEMP's Decision Analysis section.

3. National Institute of Standards and Technology. (2018). Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (NIST SP 800-160

Vol. 1).

Reference: Appendix F.2

"Technical Processes

" page F-3. It describes the Decision Management Process from ISO/IEC/IEEE 15288

which involves analyzing "potential solutions against a set of weighted criteria to support decisions."

4. Defense Acquisition University. (2022). Systems Engineering Plan (SEP) Outline (Version 4.0).

Reference: Section 3.1.3

"Decision Analysis." The outline requires this section to "Describe the program’s trade-off analysis methodology and how it will be used to support decision making." The SEP is the Department of Defense's equivalent of a SEMP.

Six Sigma is a disciplined, data-driven methodology used to improve processes by eliminating defects. A defect is defined as any non-conformance of a product or service to its specifications. The core principle of Six Sigma is to reduce process variation to the point where there are no more than 3.4 defects per million opportunities (DPMO). It achieves this by using a structured framework, such as DMAIC (Define, Measure, Analyze, Improve, Control), and statistical methods to identify and remove the root causes of defects and minimize variability in manufacturing and business processes, thereby improving the quality of the output.

1. Pyzdek

T.

& Keller

P. A. (2014). The Six Sigma Handbook (4th ed.). McGraw-Hill Education. In Chapter 1

"What Is Six Sigma?"

it is defined as a methodology that "is a rigorous

focused

and highly effective implementation of proven quality principles and techniques... aimed at virtually eliminating defects from every product

process

and transaction" (p. 5).

2. Antony

J.

& Banuelas

R. (2002). Key ingredients for the effective implementation of Six Sigma program. Measuring Business Excellence

6(4)

20-27. The authors state

"Six Sigma is a business strategy and a systematic methodology to improve... process performance

and to enhance customer satisfaction by reducing the number of defects" (p. 20). https://doi.org/10.1108/13683040210451679

3. De Feo

J. A.

& Juran

J. M. (2010). Juran's Quality Handbook: The Complete Guide to Performance Excellence (6th ed.). McGraw-Hill. Chapter 22

"Six Sigma and Other Improvement Methodologies

" describes Six Sigma as a "business improvement approach that seeks to find and eliminate causes of defects and errors in manufacturing and service processes by focusing on outputs that are critical to customers" (p. 587).

4. MIT OpenCourseWare. (2004). 16.853 Advanced System Design and Management I. Lecture 5: Quality and Process Control. The lecture notes define Six Sigma as a "disciplined

data-driven approach and methodology for eliminating defects" and notes its goal is to reduce variability and defects to a level of 3.4 DPMO (Slides 12-14).

Residual risk is the level of risk that remains after security controls and other risk mitigation measures have been implemented. It is a fundamental concept in risk management, representing the risk that the organization has either consciously accepted or has not been able to eliminate. The formula is often expressed as: Residual Risk = Inherent Risk - Impact of Controls. This remaining risk must be formally addressed by management through acceptance, transference, or further mitigation efforts if it exceeds the organization's risk appetite.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication (SP) 800-30 Revision 1

Guide for Conducting Risk Assessments.

Reference: Section 2.2.4

Page 11. The document states

"Residual risk is the risk that remains after risk responses have been implemented." The term is also formally defined in Appendix A

page A-10.

2. International Organization for Standardization (ISO). (2018). ISO/IEC 27005:2018

Information technology — Security techniques — Information security risk management.

Reference: Clause 3.13. This standard defines residual risk as the "risk remaining after risk treatment." "Risk treatment" is the process of implementing controls.

3. Anderson

R. (2020). Security Engineering: A Guide to Building Dependable Distributed Systems (3rd ed.). Wiley.

Reference: Chapter 25

Section 25.3.1

Page 868. The text explains

"The risk that remains after you’ve applied controls is called the residual risk; management must then decide whether to accept it

or to spend more on further controls."

4. Peltier

T. R. (2010). Information Security Risk Analysis (3rd ed.). Auerbach Publications.

Reference: Chapter 1

Page 6. The book defines residual risk as "the risk that remains after controls are implemented." It is described as a key output of the risk assessment process that informs management's risk acceptance decisions. (DOI: https://doi.org/10.1201/EBK1439839560)

The Department of Defense’s net-centric vision explicitly states that its purpose is “to securely connect people and systems independent of time or location,” thereby enabling rapid, trusted information sharing and decision-making across the enterprise. This goal underlies Net-Centric Operations/Warfare (NCOW) and guides related architectures (e.g., GIG, DoDAF views). Hence, the term that completes the statement is “Net-centric.”

1. U.S. DoD Chief Information Officer

“DoD Net-Centric Data Strategy

” 9 May 2003

p. 1

para 2: “The Department’s net-centric vision is to securely connect people and systems independent of time or location…”.

2. U.S. DoD CIO

“DoD Net-Centric Services Strategy

” 4 May 2007

p. 3

Executive Summary: “DoD’s net-centric vision—securely connecting people and systems anytime

anywhere…”.

3. Alberts

Garstka & Stein

“Network Centric Warfare: Developing and Leveraging Information Superiority

” CCRP

2nd ed.

2000

Chapter 1

p. 13

describing the net-centric objective of ubiquitous

secure connectivity.