BaselineWatch
Apply as published
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

macOS APPL-26-002060

DISA STIG APPL-26-002060 (CAT I): The macOS system must apply gatekeeper settings to block applications from unidentified developers.

DISA STIG recommends

APPL-26-002060 CAT I

The macOS system must apply gatekeeper settings to block applications from unidentified developers.

NIST SP 800-53: CM-5, CM-14, SI-7(1), SI-7(15)

mSCP rule system_settings_gatekeeper_identified_developers_allowed · in 800-171, 800-53r5_high, 800-53r5_low, 800-53r5_moderate, DISA-STIG, all_rules, cmmc_lvl2, cnssi-1253_high…

Configuration profile

com.apple.systempolicy.control
  AllowIdentifiedDevelopers = true
  EnableAssessment = true
Check

Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('AllowIdentifiedDevelopers')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment')) if ( pref1 == true && pref2 == true ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix

Configure the macOS system to apply gatekeeper settings to block applications from unidentified developers by installing the "com.apple.systempolicy.control" configuration profile.

Our decision

Apply as published

No decision recorded: the recommendation stands. The owner signs in to change it.

All macOS decisions · The macOS baseline · The macOS test plan