Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

Question

Options

• ASSAA
• BTCSEC
• CFIPS
• DFITSAF

• B
  91% (29)
• C
  6% (2)
• D
  3% (1)

Explanation

TCSEC (Trusted Computer System Evaluation Criteria), known as the "Orange Book," is the standard specifically designed to evaluate and set baseline requirements for assessing the effectiveness of security controls built into computer systems - making B correct. SSAA (System Security Authorization Agreement) is a DoD documentation artifact for authorizing system operation, not an evaluation standard. FIPS (Federal Information Processing Standards) are NIST-published standards covering a broad range of computing topics (encryption, hashing, etc.), not specifically a framework for evaluating built-in security controls. FITSAF (Federal IT Security Assessment Framework) is a maturity model for assessing agency-level IT security programs, not individual system controls.

Memory tip: Think "TCSEC = Trusted Criteria" - if a standard has Trust in the name and comes from the DoD era (1985), it's the one grading how trustworthy a system's built-in security is.

No community discussion yet for this question.