A specification that defines security-related data objects and rules about how the objects are used to maintain security on a computer system.