The divisions and classes are:

D Minimal protection
C Discretionary protection
C1 Discretionary Security Protection
C2 Controlled Access Protection
B Mandatory Protection
B1 Labeled Security
B2 Structured Protection
B3 Security Domains
A Verified Protection
A1 Verified Design


EAL 1 : functionally tested
EAL 2 : structurally tested
EAL 3 : methodically tested and checked
EAL 4 : methodically designed, tested and reviewed
EAL 5 : semifomally designed and tested
EAL 6 : semifomally verified design and tested
EAL 7 : fomally verified design and tested.





Each division and class expands or modifies as indicated the requirements of the immediately prior
division or class.
D Minimal protection
Reserved for those systems that have been evaluated but that fail to meet the requirements for a
higher division
C Discretionary protection
C1 Discretionary Security Protection
o Identification and authentication
o Separation of users and data
o Discretionary Access Control (DAC) capable of enforcing access limitations on an individual basis
o Required System Documentation and user manuals
C2 Controlled Access Protection
o More finely grained DAC
o Individual accountability through login procedures
o Audit trails
o Object reuse
o Resource isolation
B Mandatory protection
B1 Labeled Security Protection
o Informal statement of the security policy model
o Data sensitivity labels
o Mandatory Access Control (MAC) over selected subjects and objects
o Label exportation capabilities
o All discovered flaws must be removed or otherwise mitigated
o Design specifications and verification
B2 Structured Protection
o Security policy model clearly defined and formally documented
o DAC and MAC enforcement extended to all subjects and objects
o Covert storage channels are analyzed for occurrence and bandwidth
o Carefully structured into protection-critical and non-protection-critical elements
o Design and implementation enable more comprehensive testing and review
o Authentication mechanisms are strengthened
o Trusted facility management is provided with administrator and operator segregation
o Strict configuration management controls are imposed
B3 Security Domains
o Satisfies reference monitor requirements
o Structured to exclude code not essential to security policy enforcement
o Significant system engineering directed toward minimizing complexity
o Security administrator role defined
o Audit security-relevant events
o Automated imminent intrusion detection, notification, and response
o Trusted system recovery procedures
o Covert timing channels are analyzed for occurrence and bandwidth
o An example of such a system is the XTS-300, a precursor to the XTS-400
A Verified protection
A1 Verified Design
o Functionally identical to B3
o Formal design and verification techniques including a formal top-level specification
o Formal management and distribution procedures
o An example of such a system is Honeywell's Secure Communications Processor SCOMP, a
precursor to the XTS-400
Beyond A1
o System Architecture demonstrates that the requirements of self-protection and completeness for
reference monitors have been implemented in the Trusted Computing Base (TCB).
o Security Testing automatically generates test-case from the formal top-level specification or formal
lower-level specifications.
o Formal Specification and Verification is where the TCB is verified down to the source code level,
using formal verification methods where feasible.
o Trusted Design Environment is where the TCB is designed in a trusted facility with only trusted
(cleared) personnel.