 Consequently, microkernel designs have been used for systems designed for high-security applications, including KeyKOS, EROS and military systems.In fact common criteria (CC) at the highest assurance level (Evaluation Assurance Level (EAL) 7) has an explicit requirement that the target of evaluation be "simple", an acknowledgment of the practical impossibility of establishing true trustworthiness for a complex system.Unfortunately, again, the term "simple" is misleading and ill-defined.