Orange Book

• D - minimal
• C1 - discretionary access control
• C2 - controlled access protection
• B1 - labelled security protection
• B2 - structured protection
• B3 - security domains
• A1 - verified design