Windows Server 2025 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-277993	WN25-00-000090	SV-277993r1182250_rule	CCI-004910	medium
Description
Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.
STIG			Date
Microsoft Windows Server 2025 Security Technical Implementation Guide			2026-02-20

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-09Cryptographic Key Management

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IA-5(1)Password-based Authentication

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-5(2)Public Key-based Authentication

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-17Public Key Infrastructure Certificates

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-28Protection of Information at Rest

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-28(1)Cryptographic Protection

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-28(3)Cryptographic Keys

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-004910

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)

Details

Check Text (C-277993r1182250_chk)

For stand-alone or nondomain-joined systems, this is not applicable. Verify the system has a TPM and it is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". TPM Manufacturer Information - Specific Version = 2.0 or 1.2 If a TPM is not found or is not ready for use, this is a finding.

Fix Text (F-82428r1180684_fix)

Ensure domain-joined systems have a TPM that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) The TPM must be enabled in the firmware. Run "tpm.msc" for configuration options in Windows.