SV-220702r958552: Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest. | Microsoft Windows 10 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

Description

Discussion Text

If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001199Not mappedCCI-002475Not mappedCCI-002476SV-77827V-63337

References

DPMS Target Microsoft Windows 10 DISA DPMS Target Microsoft Windows 10 4072

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows10:def:220702
# Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# BitLocker must be enabled on all fixed drives.
# wmi57_object (wmi57_test)
function test_1 {
  return (((Get-CimInstance -Namespace 'root\cimv2\security\microsoftvolumeencryption' -Query 'SELECT protectionstatus FROM win32_encryptablevolume' | Select-Object -First 1) | Select-Object -ExpandProperty 'protectionstatus') -eq '1')
}

if (test_1) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_10 target this check assesses.

# OVAL Definition: oval:mil.disa.stig.windows10:def:220702
$bitlockerStatus = Get-CimInstance -ClassName Win32_EncryptableVolume -Namespace root\cimv2\security\microsoftvolumeencryption
if ($bitlockerStatus -ne $null -and ($bitlockerStatus | Where-Object { $_.ProtectionStatus -eq 1 }).Count -eq $bitlockerStatus.Count) { Write-Output "PASS"; Exit 0 } else { Write-Output "FAIL"; Exit 1 }

Remediation

Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.

BitLocker, included in Windows, can be enabled in the Control Panel under "BitLocker Drive Encryption" as well as other management tools.

NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).