Microsoft Windows 11 Security Technical Implementation Guide

The Microsoft Windows 11 Security Technical Implementation Guide (V2 R11) has 257 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

257STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R11

CurrentPublished Wed Sep 30 2026

Secure Boot must be enabled on Windows 11 systems.

Microsoft Windows 11 Security Technical Implementation Guide

Assessment Title

Rule Text

Secure Boot must be enabled on Windows 11 systems.

Description

Discussion Text

Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 11, including virtualization-based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-253257

Rule

SV-253257r1210281_rule

Severity

medium

Rule Version

WN11-00-000020

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the system firmware is configured for Secure Boot.

Run "System Information".

Under "System Summary", if "Secure Boot State" does not display "On", this is a finding.

Implementation Procedure

Fix Text

Enable Secure Boot in the system firmware.

STIG check 4 of 257 in the Microsoft Windows 11 STIG checklist

← Previous · V-253256Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.Next · V-253259 →Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.