Basic Input/Output System (BIOS) is firmware that initialises hardware and starts the boot process before the operating system loads. Defenders monitor BIOS configuration, boot order, and firmware integrity because attackers can alter startup settings or implant persistent malware. Missing firmware controls can allow unauthorised booting or hidden persistence.
What BIOS Does During Startup
BIOS is the first firmware layer that initialises core hardware, performs startup checks, and hands control to the next boot stage. Because it runs before the operating system, it helps establish the initial trust boundary for the entire device.
That early position is what makes BIOS operationally important. If the startup sequence is changed or the firmware itself is altered, the machine can still appear to boot normally while following a different, attacker-influenced path.
Why BIOS Matters for Integrity and Trust
Defenders care about BIOS because it influences what code gets control first, which boot device is trusted, and whether firmware-level tampering can survive across reinstalls. A compromised BIOS can undermine the operating system before host protections are active.
This is why boot order, firmware configuration, and platform integrity are security controls rather than simple setup options. If those values are weakly governed, an attacker may redirect booting to removable media, insert persistence, or weaken the device’s startup trust chain.
Common BIOS Security Weaknesses
BIOS weaknesses usually show up as insecure configuration, outdated firmware, or lack of visibility into hardware-level changes. The most serious failures are those that let unauthorised startup behaviour persist without clear signs at the operating-system layer.
Persistent malware at the firmware layer is especially dangerous because it can survive disk reimaging and can interfere with security tools that rely on a clean boot path. For that reason, BIOS integrity checks belong alongside endpoint and firmware monitoring, not after them.
How Organisations Should Govern BIOS
BIOS should be treated as part of the device security baseline. Organisations should know which platforms they own, which firmware versions are approved, and which settings are required for secure boot behaviour, admin protection, and controlled boot sources.
That governance also extends to change control and recovery. When firmware settings drift, or when a machine shows unexplained boot changes, teams need a documented way to verify configuration, restore a trusted baseline, and confirm the platform has not been altered below the operating system.
Risk and Threat Considerations
BIOS risk is concentrated in pre-OS persistence and boot-path manipulation. If an attacker can change firmware settings or implant code below the operating system, normal endpoint defenses may miss the compromise and the malware can remain after rebuilds.
Failure mechanism: The attacker abuses the early boot trust chain, using firmware access, insecure boot order, or tampered startup code to gain durable control before higher-level security tooling loads.
Impact: The device may boot into attacker-controlled code, expose credentials or secrets during startup, and require firmware-level remediation rather than ordinary malware removal.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-6 — Configuration Settings | BIOS security depends on controlled startup and firmware configuration |
| SI-7 — Software, Firmware, and Information Integrity | BIOS integrity is a firmware-integrity problem at boot time | |
| Recommendation — Enforce approved firmware settings and review BIOS changes as part of configuration control. Verify firmware integrity and investigate signs of pre-OS tampering. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Device firmware and boot settings are part of secure infrastructure management |
| Recommendation — Inventory and harden platform firmware settings across managed endpoints. | ||
| NIST CSF 2.0 | PR.DS-8 — Integrity is protected using cryptographic mechanisms | BIOS trust depends on integrity protection for boot components |
| Recommendation — Protect boot integrity with verified firmware and trusted startup controls. | ||
Practitioner Guidance
Why practitioners should care: BIOS is not just configuration, it is a control surface for the system’s first trusted execution steps. If it is unmanaged, every later control inherits that weakness.
What to watch for: Unexpected boot device changes, unexplained firmware setting drift, or machines that keep showing suspicious behaviour after a standard rebuild. Those signals justify a deeper firmware review, not just an operating-system scan.
Practitioner takeaway: Treat BIOS as part of the platform trust boundary and include it in asset inventory, hardening, and compromise-response procedures.