Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

FITSAF (Federal Information Technology Security Assessment Framework) is a framework related to assessment processes but not the fundamental standard for defining security control requirements and evaluation criteria like TCSEC.

FIPS (Federal Information Processing Standards) are a broad set of standards published by NIST, and while some FIPS documents define security requirements (e.g., FIPS 140-2 for cryptographic modules), TCSEC is the specific historic standard for evaluating overall system security effectiveness.

TCSEC (Trusted Computer System Evaluation Criteria), also known as the 'Orange Book,' is a historic U.S. government standard that established a set of criteria and evaluation classes for assessing the security effectiveness of computer systems. It defined different levels of trust based on the integrity and assurance of the system's security features.

SSAA (System Security Accreditation Agreement) is a document that formalizes the accreditation decision within a C&A process, not a standard for assessing the effectiveness of computer security controls.