2 cissp ® Official Study Guide Eighth Edition

TCSEC
ITSEC
CC description
 
D
F-D+E0
EAL0, EAL1
Minimal/no protection
C1
F-C1+E1
EAL2
Discretionary security mechanisms
C2
F-C2+E2
EAL3
Controlled access protection
B1
F-B1+E3
EAL4
Labeled security protection
B2
F-B2+E4
EAL5
Structured security protection
B3
F-B3+E5
EAL6
Security domains
A1
F-B3+E6
EAL7
Verified security design
Industry and International Security
Implementation Guidelines
In addition to overall security access models, such as Common Criteria, there are many 
other more specific or focused security standards for various aspects of storage, com-
munication, transactions, and the like. Two of these standards you should be familiar 
with are 
Payment Card Industry Data Security Standard (PCI DSS)
and 
International 
Organization for Standardization (ISO)
.
PCI DSS is a collection of requirements for improving the security of electronic pay-
ment transactions. These standards were defined by the PCI Security Standards Council 
members, who are primarily credit card banks and financial institutions. The PCI DSS 

---

306
Chapter 8 
■
Principles of Security Models, Design, and Capabilities
defi nes requirements for security management, policies, procedures, network architecture, 
software design, and other critical protective measures. For more information on PCI DSS, 
please visit the website at
www.pcisecuritystandards.org
 . 
ISO is a worldwide standards-setting group of representatives from various national 
standards organizations. ISO defi nes standards for industrial and commercial equip-
ment, software, protocols, and management, among others. It issues six main products: 
International Standards, Technical Reports, Technical Specifi cations, Publicly Available 
Specifi cations, Technical Corrigenda, and Guides. ISO standards are widely accepted across 
many industries and have even been adopted as requirements or laws by various govern-
ments. For more information on ISO, please visit the website at
www.iso.org
 .