I-0039: Multilevel Printers And Page Labeling

NUMBER:               I-0039
STATUS:               Approved by CCEVS Management and Mailed to Public Mailing
                      List

TITLE:                Multilevel Printers And Page Labeling
APPROVAL POSTING:     [announce 0332]

EFFECTIVE:            1993-10-20

REQUIREMENT:          Labeling Human Readable Output
CRITERIA CLASSES:     B1, B2, B3, A1
DOCUMENT(S):          <None>
RELATED TO:
     I-0040           Requirements For Overwrite Label Capability
     I-0253           Default Page Marking Format

STATEMENT:

The following interprets the requirement that ``The TCB shall, by default, mark the top and bottom of each page of human-readable, paged, hardcopy output (e.g., line printer output) with human-readable sensitivity labels that properly represent the overall sensitivity of the output or that properly represent the sensitivity of the information on the page.''

For each printer included in a product's evaluated configuration that can handle multiple levels of output without administrative intervention (i.e., that is used as a multilevel device), the TCB shall be capable of marking at least one form of the printer's output (e.g., text output) with a label at the top and bottom of each page as required.

PROJECTED IMPACT:

This reverses previous guidance that said as long as one available printer supports page labeling, others need not.

SUPPORT:

If an evaluated configuration of the product can include printers that are used as multilevel devices and are incapable of printing page labels, it is hard to see how such a configuration can be said to print page labels ``by default''.

The phrase ``at least one form of output'' permits the inclusion of printers that cannot reliably provide page labels on some forms of output (e.g., graphics, PostScript) as long as they possess the minimal capability of producing some useful form of output (such as ASCII text) with TCB-provided page labels.

The FER should include or reference guidance on the risk of using printers not in the evaluated configuration, or using evaluated printers with the forms of output that the TCB cannot guarantee default markings (which should cause an audit message).