CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

Control

Set Correctly Yes No

18.8.5.1

(NG) Ensure 'Turn On Virtualization Based Security' is set to 'Enabled' (Scored)  

18.8.5.2

(NG) Ensure 'Turn On Virtualization Based Security: Select Platform Security Level' is set to 'Secure Boot and DMA Protection' (Scored) (NG) Ensure 'Turn On Virtualization Based Security: Virtualization Based Protection of Code Integrity' is set to 'Enabled with UEFI lock' (Scored)





18.8.5.3





18.8.5.4

(NG) Ensure 'Turn On Virtualization Based Security: Require UEFI Memory Attributes Table' is set to 'True (checked)' (Scored)   (NG) Ensure 'Turn On Virtualization Based Security: Credential Guard Configuration' is set to 'Enabled with UEFI lock' (Scored)  

18.8.5.5

18.8.5.6

(NG) Ensure 'Turn On Virtualization Based Security: Secure Launch Configuration' is set to 'Enabled' (Scored)





18.8.6 18.8.7

Device Health Attestation Service

Device Installation

18.8.7.1 18.8.7.1.1

Device Installation Restrictions

(BL) Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled' (Scored) (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Prevent installation of devices that match any of these device IDs' is set to 'PCI\CC_0C0A' (Scored) (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked) (Scored) (BL) Ensure 'Prevent installation of devices using drivers that match these device setup classes' is set to 'Enabled' (Scored)





18.8.7.1.2





18.8.7.1.3





18.8.7.1.4





18.8.7.1.5

(BL) Ensure 'Prevent installation of devices using drivers that match these device setup classes: Prevent installation of devices using drivers for these device setup' is set to 'IEEE 1394 device setup classes' (Scored)  

18.8.7.1.6

(BL) Ensure 'Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed.' is set to 'True' (checked) (Scored)





18.8.8 18.8.9

Device Redirection

DiskNV Cache

1255 | P a g e