STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host must implement Secure Boot enforcement.

DISA Rule

SV-256447r959010_rule

Vulnerability Number

V-256447

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-70-000095

Severity

CAT II

CCI(s)

• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.

Weight

10

Fix Recommendation

This setting cannot be configured until Secure Boot is properly enabled in the BIOS.

From an ESXi shell, run the following command:

# esxcli system settings encryption set --require-secure-boot=true

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.settings.encryption.set.CreateArgs()
$arguments.requiresecureboot = $true
$esxcli.system.settings.encryption.set.Invoke($arguments)

Evacuate the host and gracefully reboot for changes to take effect.

Check Contents

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From an ESXi shell, run the following command:

# esxcli system settings encryption get|grep "Secure Boot"

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.encryption.get.invoke() | Select RequireSecureBoot

Expected result:

Require Secure Boot: true

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-256447

Documentable

False

Rule Version

ESXI-70-000095

Severity Override Guidance

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From an ESXi shell, run the following command:

# esxcli system settings encryption get|grep "Secure Boot"

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.encryption.get.invoke() | Select RequireSecureBoot

Expected result:

Require Secure Boot: true

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5518