Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
System BIOS or system controllers must not allow user-level access.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-40195 | WN08-00-000011-02 | SV-55004r2_rule | Medium |
| Description |
|---|
| A system's BIOS or system controller handles the initial startup of a system, and its configuration must be protected from unauthorized modification. When the BIOS or system controller supports the creation of user accounts or passwords, such protections must be used and accounts/passwords only assigned to system administrators. Failure to protect BIOS or system controller settings could result in Denial of Service or compromise of the system resulting from unauthorized configuration changes. |
| STIG | Date |
|---|---|
| Windows 8 / 8.1 Security Technical Implementation Guide | 2016-06-08 |
Details
| Check Text ( C-69235r2_chk ) |
|---|
| If the BIOS or system controller does not support user-level access in addition to supervisor/administrator access, this is NA. If the BIOS or system controller supports user-level access in addition to supervisor/administrator access, determine whether this access is enabled. If user-level access is enabled, this is a finding. If access is restricted by way of hypervisor configuration settings on virtual systems, this would not be a finding. |
| Fix Text (F-47883r1_fix) |
|---|
| Access the system's BIOS or system controller. Disable user-level access. |