OpenControls Logo

STIG Viewer

STIGViewer Support

Secure Boot must be enabled on Windows 11 systems.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253257WN11-00-000020SV-253257r1117271_ruleCCI-002421medium
Description
Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 11, including virtualization-based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.
STIGDate
Microsoft Windows 11 Security Technical Implementation Guide2026-02-12

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-01Use of Cryptographic Controls
0.50
CRY-01.1Alternate Physical Protection
0.50
CRY-03Transmission Confidentiality
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-11Re-authentication
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3Device Identification and Authentication
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.8
1.00
CCI1 mapping
CCI-002421
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50
PR.DS-10
0.50

Details

Check Text (C-253257r1117271_chk)

Verify the system firmware is configured for Secure Boot. For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. Run "System Information". Under "System Summary", if "Secure Boot State" does not display "On", this is a finding.

Fix Text (F-56660r828854_fix)

Enable Secure Boot in the system firmware.