Recommended Free Tools
The trusted computing base (TCB) is the totality of a computer system’s protection mechanisms—hardware, firmware, and software—that together enforce its security policy. Put simply, it is the set of components the system’s security depends on to work correctly. The boundary is determined by the policy and design, not by a fixed product list or by the operating-system kernel alone.
What is the trusted computing base?
NIST defines a TCB as the totality of protection mechanisms within a computer system, including hardware, firmware, and software, whose combination is responsible for enforcing a security policy. NIST lists the term in its glossary, with definitions tied to sources including CNSSI 4009-2022 and NIST Special Publications. As NIST advises, terminology should be read in the context of the source being used.
As an Amazon Associate I earn from qualifying purchases.
A practical way to understand the definition is to ask which components must work correctly for the system to enforce its stated security requirements. This dependency-based explanation follows the National Academies’ discussion of trust: if a component must function for a system to meet its security specification, it is trusted for that security purpose, along with relevant dependencies.
What belongs inside a TCB?
Include the mechanisms needed to enforce the security policy, and consider what those mechanisms depend on. The TCB can span hardware, firmware, and software; a component’s name or position in the software stack does not settle whether it belongs.
#1 Best Overall
- Hardware: security-relevant mechanisms or components on which policy enforcement depends.
- Firmware: low-level code that a protection mechanism needs in order to operate correctly.
- Software: the security mechanisms that control access or otherwise enforce the policy, as well as components they depend on.
Use this test for a particular system: if a component or one of its dependencies failed or were compromised, could the system still enforce the stated policy? If not, it belongs in the security-relevant trust argument. The answer depends on the policy and architecture, so there is no universal inventory of TCB components.
The Orange Book, the historical Department of Defense Trusted Computer System Evaluation Criteria, describes the TCB as the elements supporting the security policy and isolation of protected objects. Depending on the system, that boundary might refer to a reference validation mechanism, such as a security kernel or front-end security filter, or to the entire trusted computer system. This is useful conceptual history, not current compliance guidance.
Is the security kernel the same as the TCB?
No. A security kernel is a core part of the TCB, not another name for the whole boundary. NIST defines it as the hardware, firmware, and software elements of a TCB that implement the reference monitor concept.
For that concept to work, the security kernel must mediate all access, be protected from modification, and be verifiable as correct. In practical terms, security-sensitive access should pass through a mechanism that applies the policy, and that mechanism should be protected and sufficiently analyzable. Other TCB components may support or depend on that mechanism without being part of the security kernel itself.
How is the TCB different from everything an organization must trust?
TCB has a specific security meaning: it centers on protection mechanisms that enforce a computer system’s security policy. An organization may also depend on people and facilities to meet broader goals. For example, security officers may set access levels, while power and other physical conditions may affect availability. Those are broader operational trust dependencies; they are not automatically part of the TCB unless the system’s stated security boundary includes them.
What does “trusted” mean here?
“Trusted” describes what the system’s security claim depends on; it does not certify that every component is inherently trustworthy, invulnerable, or free of defects. A TCB identifies the mechanisms and dependencies that must work for the policy to hold. It is a way to make the security boundary and its assumptions explicit, not proof that those assumptions are true.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to identify or compare TCB boundaries
When assessing one design—or comparing two—hold the security policy constant and work through the same questions:
- Define the policy. State what the system must protect and what enforcement means for that system.
- Trace enforcement. Identify the hardware, firmware, and software mechanisms responsible for applying the policy.
- Follow dependencies. Determine which lower-level components those mechanisms require in order to remain effective.
- Check access mediation. Establish whether the relevant accesses pass through the security kernel or reference monitor.
- Check protection and verifiability. Ask whether the enforcement mechanism is protected from modification and can be verified as correct.
These questions are a practical way to reason about the boundary based on the definition and security-kernel criteria; they are not a standardized scoring rubric.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
