The ESXi host must enable Secure Boot.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256430 | ESXI-70-000076 | SV-256430r959010_rule | CCI-000366 | medium |
| Description | ||||
| Secure Boot is part of the Unified Extensible Firmware Interface (UEFI) firmware standard. With UEFI Secure Boot enabled, a host refuses to load any UEFI driver or app unless the operating system bootloader has a valid digital signature. Secure Boot for ESXi requires support from the firmware and requires that all ESXi kernel modules, drivers, and vSphere Installation Bundles (VIBs) be signed by VMware or a partner subordinate. Secure Boot is enabled in the BIOS of the ESXi physical server and supported by the hypervisor boot loader. There is no ESXi control to "turn on" Secure Boot. Requiring Secure Boot (failing to boot without it present) is accomplished in another control. | ||||
| STIG | Date | |||
| VMware vSphere 7.0 ESXi Security Technical Implementation Guide | 2025-02-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R4 · disa_xccdf · related
Details
Check Text (C-256430r959010_chk)
From an ESXi shell, run the following command:
# /usr/lib/vmware/secureboot/bin/secureBoot.py -s
If the output is not "Enabled", this is a finding.
Fix Text (F-60048r886070_fix)
From an ESXi shell, run the following command:
# /usr/lib/vmware/secureboot/bin/secureBoot.py -c
If the output indicates that Secure Boot cannot be enabled, correct the discrepancies and try again.
If the discrepancies cannot be rectified, this finding is downgraded to a CAT III.