The Orange Book, formally the Trusted Computer System Evaluation Criteria, was issued in 1983 by the National Computer Security Center as a US Department of Defense standard. It sorted systems into divisions D, C, B and A. It was eventually replaced by the international Common Criteria.
Where it came from
The National Computer Security Center, described as an arm of the National Security Agency, published the criteria in August 1983 and updated them in 1985. The goal was to give buyers in government a common way to say how much protection a system offered.
The four divisions
The scheme was a ladder, with each step demanding more:
- D, minimal protection. Reserved for systems that were evaluated and failed to meet a higher division.
- C, discretionary protection. Classes C1 and C2. Owners decide who may access their data.
- B, mandatory protection. Classes B1, B2 and B3. The system enforces access rules that users cannot override.
- A, verified protection. Class A1. The highest division, with a design that is verified.
The key idea was the jump from discretionary to mandatory control. In C, a user can share files at will. In B, the system enforces labels regardless of what a user wants.
What replaced it
The Wikipedia article says the Orange Book was eventually replaced by the Common Criteria. It gives 1999 as the replacement date, and states that the Common Criteria were originally published in 2005, a claim tagged as needing a citation. Those dates do not obviously fit together, so check the Common Criteria publication history directly before quoting either one.
The article does not give a reason for the replacement. It would be a guess to say why, so this post does not offer one.
What is still useful
The Orange Book framed a question that audits still ask: how do you know the system enforces what it claims? The answer in 1983 was graded evaluation. Today the answer might be policy as code, logs, evidence collection and independent review.
If you work in compliance, the useful habit is to ask of any framework what it measures: design, operation, or both. An evaluation of design says little about how a system behaves on a Tuesday afternoon.
How to read old frameworks
Older standards can look rigid, but they teach something useful: each one tried to make assurance comparable. When you read any framework, ask three questions. What object is being evaluated, a product, a process or an organisation? What evidence is accepted? And who judges it? The Orange Book evaluated systems against fixed classes. Many current frameworks evaluate organisations and ask for evidence over time. Neither is better in every case, but confusing them leads to wrong claims, such as calling a process audit a product certification. Keep that distinction in mind when a buyer asks what your assurance level is.
Quick check
Which division was the highest?
Division A, verified protection, with class A1.
Who issued the Orange Book?
The National Computer Security Center, as a US Department of Defense standard.
For modern evidence collection, Safeguard offers compliance and evidence automation, and there is a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
