Secure Boot must be enabled on Windows 11 systems.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253257 | WN11-00-000020 | SV-253257r1210281_rule | CCI-002421 | medium |
| Description | ||||
| Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 11, including virtualization-based Security and Credential Guard. If Secure Boot is turned off, these security features will not function. | ||||
| STIG | Date | |||
| Microsoft Windows 11 Security Technical Implementation Guide | 2026-05-19 | |||
Details
Check Text (C-253257r1210281_chk)
Verify the system firmware is configured for Secure Boot.
Run "System Information".
Under "System Summary", if "Secure Boot State" does not display "On", this is a finding.
Fix Text (F-56660r828854_fix)
Enable Secure Boot in the system firmware.