Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For an army project we need to know whether Windows XP, both client and corresponding server os, are c2 certified. Are they?

Are there any resources on that, like guidelines how to configure for c2 security level?

share|improve this question
up vote 1 down vote accepted

No, XP is not C2 certified, nor are any TCSEC certifications being done anymore. NT achieved a standalone (i.e., no network drivers) C2 with a specific Compaq hardware configuration. If you want a Windows client/server arrangement with even a C2 TCSEC rating, you're out of luck.

C2 (discretionary access) requirements can be met by most multiuser operating systems. Security auditing is sometimes initially missing, but has been added for these information assurance requirements. So even without the certification, you may be able to meet your project's requirements.

Meanwhile, the currently used standards are referred to as the Common Criteria. The wikipedia article is a good introduction, and the official organizational home page is here. Roughly speaking, TCSEC C2 would be an EAL4 certification, and, luckily for your project, XP and Server 2003 have EAL4 certs.

share|improve this answer
Thank you. I guess EAL4 is weaker than C2, as it is only based on documentation and design papers, not on testing software. – malach May 10 '10 at 12:50

It depends on how the systems are actually configured, but yes, they can succesfully fulfill the requirements.

This link is quite outdated, but should help you anyway:

share|improve this answer
Newer documents from MS show that XP only is "in the working" for c2 certification, but they are outdated too (more than 1 year old). Any newer information? – malach May 10 '10 at 11:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.