Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer…

The Trusted Computer System Evaluation Criteria (TCSEC), often called the "Orange Book," is a U.S. Department of Defense (DoD) standard published in 1983. Its primary purpose was to provide a framework for evaluating the effectiveness of security controls built into computer systems. It established a series of hierarchical security classifications (e.g., D, C1, C2, B1, B2, B3, A1) based on the system's ability to enforce a security policy, provide assurance, and implement specific security features. TCSEC was the foundational standard for assessing and rating the trust and security level of computer operating systems.

A. SSAA: A System Security Authorization Agreement (SSAA) is a procedural document used in the U.S. government's former C&A process, not a standard for evaluating technical controls.

C. FIPS: Federal Information Processing Standards (FIPS) are a series of diverse standards for U.S. non-military government agencies. It is a family of standards, not a single standard for this specific purpose.

D. FITSAF: The Federal Information Technology Security Assessment Framework (FITSAF) was a high-level framework for agencies to assess risk, not a standard for evaluating the effectiveness of built-in system controls.

1. National Institute of Standards and Technology (NIST). (n.d.). Trusted Computer System Evaluation Criteria (TCSEC). In Glossary. Computer Security Resource Center (CSRC). Retrieved from https://csrc.nist.gov/glossary/term/tcsec. The glossary entry states

"A U.S. Government Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system."

2. Department of Defense. (1985

December 26). DoD 5200.28-STD: Trusted Computer System Evaluation Criteria. National Computer Security Center. This is the original standard document. The abstract states its purpose is to provide "a basis for the evaluation of effectiveness of security controls built into automatic data processing system products."

3. Anderson

R. J. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems (2nd ed.). Wiley. Chapter 24

"Evaluation and Certification

" discusses the history of evaluation criteria

starting with TCSEC (p. 825)

describing it as the first comprehensive attempt to provide criteria for designing and evaluating secure systems.

4. Evans

D. (2011). CS 6501: Trustworthy Computing - Lecture 3: The Orange Book. University of Virginia

Department of Computer Science. Course materials describe TCSEC as the "first standard for computer security" and detail its evaluation classes for assessing security controls.