Credential Guard must be running on Windows 10 domain-joined systems.
Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.
How this relates to the STIG checklist: STIG vs SCAP benchmark.