Which Orange Book security rating requires that formal techniques are used to prove the equivalence between the TCB specifications and the security policy model?
which security level is the first to require a system to support separate operator and system administrator rules?