Secure Boot

Secure Boot is a startup security feature that verifies whether early boot software is trusted before the operating system loads. It helps prevent unauthorized bootloaders, bootkits, and other low-level threats from running before normal security controls are active.

Secure Boot works by checking digital signatures during the boot process. Firmware verifies that each boot component is signed by a trusted authority or approved key before allowing it to run, helping preserve device integrity from the earliest startup stage.

Secure Boot is important because some attacks target the boot process before endpoint protection tools, logging, or user authentication are available. By enforcing trusted startup components, organizations reduce the risk of persistent malware and unauthorized system tampering.

Secure Boot is not universally required in every compliance program, but it is often relevant to security frameworks and compliance standards that expect secure configuration, endpoint hardening, system integrity, and risk-based technical controls. Organizations should evaluate whether it applies to their devices and risk profile.

Secure Boot compliance requirements typically include enabling the feature where supported, documenting configuration baselines, monitoring device status, reviewing exceptions, and retaining evidence that critical endpoints and servers use approved startup settings. Requirements should be mapped to the organization’s applicable standards and internal policies.

Secure Boot status can usually be checked through operating system settings, device management tools, UEFI firmware settings, endpoint inventory reports, or command-line utilities. For compliance purposes, organizations should prefer repeatable evidence from managed systems instead of relying only on manual screenshots.

Secure Boot is typically managed in UEFI firmware settings by selecting the Secure Boot option and ensuring the system uses compatible boot mode, trusted keys, and signed boot components. Changes should be tested carefully, especially on encrypted, dual-boot, or legacy systems.

Secure Boot verifies trusted software before and during the early boot process, while Trusted Boot usually refers to later operating system integrity checks after firmware has handed off control. Together, they help establish a chain of trust from device startup through operating system loading.

Secure Boot does not always require a TPM, because it relies primarily on firmware-based signature verification. However, TPM-based capabilities can complement Secure Boot by supporting measured boot, device health checks, disk encryption, and stronger evidence of system integrity.

Disabling Secure Boot can increase exposure to bootkits, rootkits, unauthorized bootloaders, and other attacks that modify the startup process. It can also weaken endpoint hardening evidence and make it harder to demonstrate that systems start from a trusted configuration.