Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253256 | WN11-00-000015 | SV-253256r1210280_rule | CCI-002421 | medium |
| Description | ||||
| UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 11, including virtualization-based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features. | ||||
| STIG | Date | |||
| Microsoft Windows 11 Security Technical Implementation Guide | 2026-05-19 | |||
Details
Check Text (C-253256r1210280_chk)
Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.
Run "System Information".
Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding.
Fix Text (F-56659r828851_fix)
Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.