Detections
Analytics

1.4 Host hardware must enable and configure a TPM 2.0

Information

ESXi can use Trusted Platform Modules (TPM) 2.0 to enable advanced security features that prevent malware, remove dependencies, and secure hardware lifecycle operations.

Enabling and configuring TPM 2.0 on host hardware ensures enhanced security by providing hardware-level cryptographic operations and secure storage for sensitive data and keys.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

- Place the host in maintenance mode.
 - reboot into BIOS/UEFI.
 - Enable and activate the TPM
 - Select TPM 2.0 mode, and ensure UEFI/Secure Boot prerequisites required by the server vendor are enabled.
 - Save changes.
 - reboot with command reboot
 - Verify again with esxcli hardware trustedboot get and esxcli system settings encryption get.

Impact:

No impact noted.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.4

Plugin: VMware

Control ID: 8e2d4e46a2f5b7dc8854cc247a9192b469161d7f93357d426e0565ff390c4aa0