Which of the following statements about Division \(\mathrm{C} 2\) certification according to the U.S. National Computer Center's Trusted Computer Evaluation Criteria is true?

a. Mandatory access control at the group level must be supported

b. Discretionary access control at the individual level must be supported

c. The correspondence between the top-level specification and the formal security model must be verified

d. Objects must be protected based on a formal security model