Which of the following TCSEC classes defines verified protection?

Class B defines Mandatory Protection, which includes B1 (Labeled Security Protection), B2 (Structured Protection), and B3 (Security Domains) - it is the division below Class A in the TCSEC hierarchy.

Class D defines Minimal Protection, the lowest TCSEC division, assigned to systems that were evaluated but failed to meet requirements of any higher class.

Class A is the highest division in the TCSEC security hierarchy and defines Verified Protection, with A1 (Verified Design) being its only defined subdivision. It requires formal design verification using mathematical proofs to demonstrate that the security policy is correctly implemented in the system architecture. This level of rigor goes beyond the structural and mandatory controls of Class B, making Class A the most stringent TCSEC classification.

Class C defines Discretionary Protection, covering C1 (Discretionary Security Protection) and C2 (Controlled Access Protection), which rely on user-controlled access mechanisms rather than formal verification.