DISA_STIG_Windows_10_v3r2.audit from DISA Microsoft Windows 10 v3r2 STIG

WN10-00-000005 - Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.

CAT|II

CCI|CCI-000366

Rule-ID|SV-220697r991589_rule

STIG-ID|WN10-00-000005

STIG-Legacy|SV-77809

STIG-Legacy|V-63319

Vuln-ID|V-220697

WN10-00-000010 - Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

Rule-ID|SV-220698r991589_rule

STIG-ID|WN10-00-000010

STIG-Legacy|SV-77813

STIG-Legacy|V-63323

Vuln-ID|V-220698

WN10-00-000015 - Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.

Rule-ID|SV-220699r991589_rule

STIG-ID|WN10-00-000015

STIG-Legacy|SV-91779

STIG-Legacy|V-77083

Vuln-ID|V-220699

WN10-00-000020 - Secure Boot must be enabled on Windows 10 systems.

CAT|III

Rule-ID|SV-220700r991589_rule

STIG-ID|WN10-00-000020

STIG-Legacy|SV-91781

STIG-Legacy|V-77085

Vuln-ID|V-220700

WN10-00-000025 - Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: Continuously, where ESS is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).

Rule-ID|SV-220701r1000076_rule

STIG-ID|WN10-00-000025

STIG-Legacy|SV-77833

STIG-Legacy|V-63343

Vuln-ID|V-220701

WN10-00-000030 - Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

CAT|I

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-220702r958552_rule

STIG-ID|WN10-00-000030

STIG-Legacy|SV-77827

STIG-Legacy|V-63337

Vuln-ID|V-220702

WN10-00-000031 - Windows 10 systems must use a BitLocker PIN for pre-boot authentication.

Rule-ID|SV-220703r958552_rule

STIG-ID|WN10-00-000031

STIG-Legacy|SV-104689

STIG-Legacy|V-94859

Vuln-ID|V-220703

WN10-00-000032 - Windows 10 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.

Rule-ID|SV-220704r958552_rule

STIG-ID|WN10-00-000032

STIG-Legacy|SV-104691

STIG-Legacy|V-94861

Vuln-ID|V-220704

WN10-00-000035 - The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

CCI|CCI-001774

Rule-ID|SV-220705r958808_rule

STIG-ID|WN10-00-000035

STIG-Legacy|SV-77835

STIG-Legacy|V-63345

Vuln-ID|V-220705

WN10-00-000040 - Windows 10 systems must be maintained at a supported servicing level.

Rule-ID|SV-220706r991589_rule

STIG-ID|WN10-00-000040

STIG-Legacy|SV-77839

STIG-Legacy|V-63349

Vuln-ID|V-220706

WN10-00-000045 - The Windows 10 system must use an anti-virus program.

Rule-ID|SV-220707r1016358_rule

STIG-ID|WN10-00-000045

STIG-Legacy|SV-77841

STIG-Legacy|V-63351

Vuln-ID|V-220707

WN10-00-000050 - Local volumes must be formatted using NTFS.

CCI|CCI-000213

Rule-ID|SV-220708r958472_rule

STIG-ID|WN10-00-000050

STIG-Legacy|SV-77843

STIG-Legacy|V-63353

Vuln-ID|V-220708

WN10-00-000055 - Alternate operating systems must not be permitted on the same system.

Rule-ID|SV-220709r991589_rule

STIG-ID|WN10-00-000055

STIG-Legacy|SV-77845

STIG-Legacy|V-63355

Vuln-ID|V-220709

WN10-00-000060 - Non system-created file shares on a system must limit access to groups that require it.

CCI|CCI-001090

Rule-ID|SV-220710r958524_rule

STIG-ID|WN10-00-000060

STIG-Legacy|SV-77847

STIG-Legacy|V-63357

Vuln-ID|V-220710

WN10-00-000065 - Unused accounts must be disabled or removed from the system after 35 days of inactivity.

CCI|CCI-000795

CCI|CCI-003627

Rule-ID|SV-220711r1016403_rule

STIG-ID|WN10-00-000065

STIG-Legacy|SV-77849

STIG-Legacy|V-63359

Vuln-ID|V-220711

WN10-00-000070 - Only accounts responsible for the administration of a system must have Administrator rights on the system.

CCI|CCI-002235

Rule-ID|SV-220712r958726_rule

STIG-ID|WN10-00-000070

STIG-Legacy|SV-77851

STIG-Legacy|V-63361

Vuln-ID|V-220712

WN10-00-000075 - Only accounts responsible for the backup operations must be members of the Backup Operators group.

Rule-ID|SV-220713r991589_rule

STIG-ID|WN10-00-000075

STIG-Legacy|SV-77853

STIG-Legacy|V-63363

Vuln-ID|V-220713

WN10-00-000080 - Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.

CCI|CCI-000381

Rule-ID|SV-220714r958478_rule

STIG-ID|WN10-00-000080

STIG-Legacy|SV-77855

STIG-Legacy|V-63365

Vuln-ID|V-220714

WN10-00-000085 - Standard local user accounts must not exist on a system in a domain.

Rule-ID|SV-220715r991589_rule

STIG-ID|WN10-00-000085

STIG-Legacy|SV-77857

STIG-Legacy|V-63367

Vuln-ID|V-220715

WN10-00-000090 - Accounts must be configured to require password expiration.

CCI|CCI-000199

CCI|CCI-004066

Rule-ID|SV-220716r1016404_rule

STIG-ID|WN10-00-000090

STIG-Legacy|SV-77861

STIG-Legacy|V-63371

Vuln-ID|V-220716

WN10-00-000095 - Permissions for system files and directories must conform to minimum requirements.

CCI|CCI-002165

Rule-ID|SV-220717r958702_rule

STIG-ID|WN10-00-000095

STIG-Legacy|SV-77863

STIG-Legacy|V-63373

Vuln-ID|V-220717

WN10-00-000100 - Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

Rule-ID|SV-220718r958478_rule

STIG-ID|WN10-00-000100

STIG-Legacy|SV-77867

STIG-Legacy|V-63377

Vuln-ID|V-220718

WN10-00-000105 - Simple Network Management Protocol (SNMP) must not be installed on the system.

CCI|CCI-000382

Rule-ID|SV-220719r958480_rule

STIG-ID|WN10-00-000105

STIG-Legacy|SV-77871

STIG-Legacy|V-63381

Vuln-ID|V-220719

WN10-00-000107 - Copilot in Windows must be disabled for Windows 10.

Rule-ID|SV-268315r1016354_rule

STIG-ID|WN10-00-000107

Vuln-ID|V-268315

WN10-00-000110 - Simple TCP/IP Services must not be installed on the system.

Rule-ID|SV-220720r958478_rule

STIG-ID|WN10-00-000110

STIG-Legacy|SV-77873

STIG-Legacy|V-63383

Vuln-ID|V-220720

WN10-00-000115 - The Telnet Client must not be installed on the system.

Rule-ID|SV-220721r958480_rule

STIG-ID|WN10-00-000115

STIG-Legacy|SV-77875

STIG-Legacy|V-63385

Vuln-ID|V-220721

WN10-00-000120 - The TFTP Client must not be installed on the system.

Rule-ID|SV-220722r958480_rule

STIG-ID|WN10-00-000120

STIG-Legacy|SV-77879

STIG-Legacy|V-63389

Vuln-ID|V-220722

WN10-00-000130 - Software certificate installation files must be removed from Windows 10.

Rule-ID|SV-220723r991589_rule

STIG-ID|WN10-00-000130

STIG-Legacy|SV-77883

STIG-Legacy|V-63393

Vuln-ID|V-220723

WN10-00-000135 - A host-based firewall must be installed and enabled on the system.

Rule-ID|SV-220724r991589_rule

STIG-ID|WN10-00-000135

STIG-Legacy|SV-77889

STIG-Legacy|V-63399

Vuln-ID|V-220724

WN10-00-000140 - Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.

Rule-ID|SV-220725r991589_rule

STIG-ID|WN10-00-000140

STIG-Legacy|SV-77893

STIG-Legacy|V-63403

Vuln-ID|V-220725

WN10-00-000145 - Data Execution Prevention (DEP) must be configured to at least OptOut.

CCI|CCI-002824

Rule-ID|SV-220726r958928_rule

STIG-ID|WN10-00-000145

Detections

Analytics

DISA Windows 10 STIG v3r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Informational Update

Detections

Analytics

DISA Windows 10 STIG v3r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Informational Update

DISA Windows 10 STIG v3r2