OpenControls Logo

STIG Viewer

STIGViewer Support

The ESXi host must enable Secure Boot.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258741ESXI-80-000094SV-258741r933284_ruleCCI-001496medium
Description
Secure Boot is part of the Unified Extensible Firmware Interface (UEFI) firmware standard. With UEFI Secure Boot enabled, a host refuses to load any UEFI driver or app unless the operating system bootloader has a valid digital signature. Secure Boot for ESXi requires support from the firmware and requires that all ESXi kernel modules, drivers, and vSphere Installation Bundles (VIBs) be signed by VMware or a partner subordinate. Secure Boot is enabled in the BIOS of the ESXi physical server and supported by the hypervisor boot loader. There is no ESXi control to "turn on" Secure Boot. Requiring Secure Boot (failing to boot without it present) is accomplished in another control.
STIGDate
VMware vSphere 8.0 ESXi Security Technical Implementation Guide2023-10-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-08.3Cryptographic Protection of Event Log Information
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (20) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4Audit Log Storage Capacity
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(1)Storage Capacity Warning
1.00
AU-5(2)Real-time Alerts
1.00
AU-6(4)Central Review and Analysis
1.00

+10 more (top 10 by confidence shown)

CCI1 mapping
CCI-001496
1.00

Details

Check Text (C-258741r933284_chk)

From an ESXi shell, run the following command: # /usr/lib/vmware/secureboot/bin/secureBoot.py -s If Secure Boot is not "Enabled", this is a finding.

Fix Text (F-62390r933283_fix)

From an ESXi shell, run the following command: # /usr/lib/vmware/secureboot/bin/secureBoot.py -c If the output indicates that Secure Boot cannot be enabled, correct the discrepancies and try again. Once all discrepancies are resolved, the server ESXi is installed on can be updated to enable Secure Boot in the firmware. To enable Secure Boot in the server's firmware follow the instructions for the specific manufacturer.