HVCI Enabled with or without UEFI Lock?

[pscook25]

I don't see any updates to CIS to determine that HVCI should be enabled Without UEFI Lock as per the OIB vs CIS rationale. Is it still accurate to misalign OIB from CIS here?

[SkipToTheEndpoint]

This is a really interesting point, and something we've been discussing a lot in the CIS community calls.

My rationale for "Without Lock" was that enforcing them "With Lock" requires physical presence at a device to undo the lock in a case where an issue occurs.

However, given that we're now EOL on Windows 10, and the hardware requirements for things like VBS shouldn't be an issue for any device running Windows 11, the next version will see a change to all three policies (Credential Guard, Configure Lsa Protected Process & Hypervisor Enforced Code Integrity) to switch to their "With Lock" setting.