If you're not aware of it already, have a look at these links as starting points.

https://en.wikipedia.org/wiki/Trusted_Computer_System_Evalua...

https://en.wikipedia.org/wiki/Security-evaluated_operating_s...

A lot of the lower-level criteria require features present in operating systems we all use from day to day.