2 cissp ® Official Study Guide Eighth Edition

Multilevel Mode
The government’s defi nition of
multilevel mode
systems pretty much 
parallels the technical defi nition given in the previous section. However, for consistency, 
we’ll express it in terms of clearance, access approval, and need to know: 
■
Some users do not have a valid security clearance for all information processed by the 
system. Thus, access is controlled by whether the subject’s clearance level dominates 
the object’s sensitivity label. 
■
Each user must have access approval for all information they will have access to on the 
system. 
■
Each user must have a valid need to know for all information they will have access to 
on the system.
As you look through the requirements for the various modes of operation approved by the 
federal government, you’ll notice that the administrative requirements for controlling the 
types of users that access a system decrease as you move from dedicated systems down to 
multilevel systems. However, this does not decrease the importance of limiting individual 
access so that users can obtain only the information they are legitimately entitled to access. 
As discussed in the previous section, it’s simply a matter of shifting the burden of enforcing 
these requirements from administrative personnel (who physically limit access to a 
computer) to the hardware and software (which control what information can be accessed 
by each user of a multiuser system). 
Multilevel security mode can also be called the
controlled security mode
.
Table 9.1 summarizes and compares these four security modes according to security clear-
ances required, need to know, and the ability to process data from multiple clearance levels 
(abbreviated PDMCL). When comparing all four security modes, it is generally understood 
that the multilevel mode is exposed to the highest level of risk. 

---