OpenControls Logo

STIG Viewer

STIGViewer Support

Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253259WN11-00-000030SV-253259r958870_ruleCCI-002475high
Description
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running.
STIGDate
Microsoft Windows 11 Security Technical Implementation Guide2026-02-12

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-11.4Cryptographic Protection
0.50
CRY-04Transmission Integrity
0.50
CRY-05Encrypting Data At Rest
0.50
DCH-07.2Encrypting Data In Storage Media
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
CM-5(3)Signed Components
1.00
CM-6Configuration Settings
1.00
CM-7(5)Authorized Software — Allow-by-exception
1.00
IA-5(1)Password-based Authentication
1.00
IA-7Cryptographic Module Authentication
1.00
SC-13Cryptographic Protection
1.00
SC-23(3)Unique System-generated Session Identifiers
1.00
SC-28Protection of Information at Rest
1.00
SC-28(1)Cryptographic Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-002475
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50

Details

Check Text (C-253259r958870_chk)

Verify all Windows 11 information systems (including SIPRNet) employ BitLocker for full disk encryption. For virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA. For AVD implementations with no data at rest, this is NA. If full disk encryption using BitLocker is not implemented, this is a finding. Verify BitLocker is turned on for the operating system drive and any fixed data drives. Open "BitLocker Drive Encryption" from the Control Panel. If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding. Note: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032).

Fix Text (F-56662r828860_fix)

Enable full disk encryption on all information systems (including SIPRNet) using BitLocker. BitLocker, included in Windows, can be enabled in the Control Panel under "BitLocker Drive Encryption" as well as other management tools. Note: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032).