CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

Control

Set Correctly Yes No

18.9.11.1.15

(BL) Ensure 'Configure use of smart cards on fixed data drives' is set to 'Enabled' (Scored)





18.9.11.1.16

(BL) Ensure 'Configure use of smart cards on fixed data drives: Require use of smart cards on fixed data drives' is set to 'Enabled: True' (Scored)  

18.9.11.2 18.9.11.2.1

Operating SystemDrives

(BL) Ensure 'Allow enhanced PINs for startup' is set to 'Enabled' (Scored) (BL) Ensure 'Allow Secure Boot for integrity validation' is set to 'Enabled' (Scored) (BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered' is set to 'Enabled' (Scored) (BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent' is set to 'Enabled: False' (Scored) (BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password' (Scored) (BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Key' is set to 'Enabled: Do not allow 256-bit recovery key' (Scored)





18.9.11.2.2





18.9.11.2.3





18.9.11.2.4





18.9.11.2.5





18.9.11.2.6





18.9.11.2.7

(BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' (Scored)  

18.9.11.2.8

(BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives' is set to 'Enabled: True' (Scored)





18.9.11.2.9

(BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS:' is set to 'Enabled: Store recovery passwords and key packages' (Scored)  

18.9.11.2.10

(BL) Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives' is set to 'Enabled: True' (Scored) (BL) Ensure 'Configure use of hardware-based encryption for operating system drives' is set to 'Enabled' (Scored)





18.9.11.2.11





1262 | P a g e