介紹了信息安全評估的定義、標準及其發(fā)展，重點討論了可信計算機系統(tǒng)評估準則中機構(gòu)化保護級評估標準安全策略中的自主訪問控制、客體重用、標記(標記完整性和標記信息的輸出)和強制訪問控制；責(zé)任中的身份鑒別和審計；保證中的操作保證(系統(tǒng)結(jié)構(gòu)、系統(tǒng)完整性、隱蔽信道分析和可信設(shè)施管理)和生命周期保障(安全測試、設(shè)計說明書和檢驗以及配置管理)；文檔中的安全特征用戶指南、可信設(shè)施指南、測試文檔和設(shè)計文檔。最后，將機構(gòu)化保護級與信息技術(shù)安全評估通用準則中的測試級5進行了比較分析.

This paper introduces the definition, standard and development on evaluation of information security; emphasis on Class of B2 in TCSEC, especially the security policy of B2, such as discretionary access control, object reuse, Labels (label integrity and exportation of labeled information) and mandatory access control. this paper also studies and analyses the other requirements for class B2, such as identification and authentication in the requirement of accountability; operational assurance (system architecture, system integrity, covert channel analysis and trusted facility management) and life-cycle assurance (security testing, design specification and verification and configuration management) in the requirement of assurance; security features user’s guide, trusted facility manual, test documentation and design documentation in the requirement of documentation. in the end of this paper, we study and comparatively analyses the class of B2 with the class of EAL5 in CC.