STIGQter: STIG Summary: Microsoft Windows PAW Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Apr 2026:

Device Guard Code Integrity Policy must be used on the Windows PAW to restrict applications that can run on the system (Device Guard User Mode Code Integrity).

DISA Rule

SV-243451r1192857_rule

Vulnerability Number

V-243451

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WPAW-00-001060

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Implement an allowlist of authorized PAW applications using Device Guard.

Check Contents

Verify Device Guard is enforcing a code integrity policy to restrict authorized applications.

Run "PowerShell" with elevated privileges (run as administrator).

Enter the following:

"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | FL *codeintegrity*"

If "UserModeCodeIntegrityPolicyEnforcementStatus" does not have a value of "2" indicating "Enforced", this is a finding.

(For reference: 0 - Not Configured; 1 - Audit; 2 - Enforced)

Alternately:

Run "System Information".

Under "System Summary", verify the following:

If "Device Guard user mode Code Integrity" does not display "Enforced", this is finding.

Vulnerability Number

V-243451

Documentable

False

Rule Version

WPAW-00-001060

Severity Override Guidance

Verify Device Guard is enforcing a code integrity policy to restrict authorized applications.

Run "PowerShell" with elevated privileges (run as administrator).

Enter the following:

"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | FL *codeintegrity*"

If "UserModeCodeIntegrityPolicyEnforcementStatus" does not have a value of "2" indicating "Enforced", this is a finding.

(For reference: 0 - Not Configured; 1 - Audit; 2 - Enforced)

Alternately:

Run "System Information".

Under "System Summary", verify the following:

If "Device Guard user mode Code Integrity" does not display "Enforced", this is finding.

Check Content Reference

M

Target Key

5405