STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 systems requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

DISA Rule

SV-278009r1211149_rule

Vulnerability Number

V-278009

Group Title

SRG-OS-000185-GPOS-00079

Rule Version

WN25-00-000250

Severity

CAT I

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-002475 - Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.
• CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

10

Fix Recommendation

Configure systems that require data-at-rest protections to employ encryption to protect the confidentiality and integrity of all persistent user-generated data and operating system-specific configuration data.

The encryption method implemented must use FIPS-compliant algorithms.

Check Contents

Note: If there is a documented and approved reason to omit data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is not applicable.

Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest.

If there is no evidence that persistent user-generated data and operating system-specific configuration data are encrypted, this is a finding.

Vulnerability Number

V-278009

Documentable

False

Rule Version

WN25-00-000250

Severity Override Guidance

Note: If there is a documented and approved reason to omit data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is not applicable.

Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest.

If there is no evidence that persistent user-generated data and operating system-specific configuration data are encrypted, this is a finding.

Check Content Reference

M

Target Key

5719