Firmware Password?

I have BitLocker encryption enabled on my Windows drive. My questions is, is a UEFI password needed to prevent changes to the UEFI settings?

I never travel with my laptop, and I only use the laptop at home. I have BitLocker with TPM-Only.

So even in case an attacker steals my laptop and tries to reset or clear the TPM settings, they will or should get the BitLocker Recovery prompt. My BitLocker keys are stored in a very secured location as well.

I also have Secure Boot enabled, but Secure Boot has nothing to do with data locally stored on my hard drive because Secure Boot only checks if the boot codes are signed or not. Correct me if I am wrong.

So, would my data be still secure without having to set a Firmware/UEFI password to prevent changes to the settings in the firmware?

So, all I need is a Yes or No answer.


Thanks in advance!

We cant give you YES/NO because you are mixing different issues that requires different solutions to different problems.
What do you need to protect your pc from, firmware setings changes or your work/personal data?
If you need to prevent your data to be accessible/readable bitlocker is enough, so the answer would be YES.
If you need to prevent firmware setup/settings changes you need BIOS/UEFI password.
If you need to prevent that your data can be erased/destroied you need to prevent phisical access to the PC.

What are you trying to achieve?

I only need to protect my data, from being accessed or read. That is all.

Bitlocker is enabled with TPM-Only protection.

So in this case, there is no need for firmware password to prevent changes as I am only concerned about the data. Am I correct?

Yes, you are correct.

Well explained, thanks!