STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must implement Secure Boot enforcement.

DISA Rule

SV-258740r1212384_rule

Vulnerability Number

V-258740

Group Title

SRG-OS-000257-VMM-000910

Rule Version

ESXI-80-000085

Severity

CAT II

CCI(s)

• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.
• CCI-002696 - Verify correct operation of organization-defined security functions.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.

Weight

10

Fix Recommendation

This setting cannot be configured until Secure Boot is properly enabled in the server's firmware.

From an ESXi shell, run the following commands:

# esxcli system settings encryption set --require-secure-boot=true
# /sbin/auto-backup.sh

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.settings.encryption.set.CreateArgs()
$arguments.requiresecureboot = $true
$esxcli.system.settings.encryption.set.Invoke($arguments)

Evacuate the host and gracefully reboot for changes to take effect.

Check Contents

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From an ESXi shell, run the following command:

# esxcli system settings encryption get

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.encryption.get.invoke() | Select RequireSecureBoot

Expected result:

Require Secure Boot: true

If "Require Secure Boot" is not set to "true", this is a finding.

Vulnerability Number

V-258740

Documentable

False

Rule Version

ESXI-80-000085

Severity Override Guidance

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From an ESXi shell, run the following command:

# esxcli system settings encryption get

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.encryption.get.invoke() | Select RequireSecureBoot

Expected result:

Require Secure Boot: true

If "Require Secure Boot" is not set to "true", this is a finding.

Check Content Reference

M

Target Key

5562