BaselineWatch
Apply as published
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

macOS APPL-26-999999

DISA STIG APPL-26-999999 (CAT I): The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

DISA STIG recommends

APPL-26-999999 CAT I

The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

NIST SP 800-53: SI-2

mSCP rule system_settings_softwareupdate_current · in 800-171, 800-53r5_high, 800-53r5_low, 800-53r5_moderate, DISA-STIG, all_rules, cis_lvl1, cis_lvl2…

Check

Verify security-relevant software updates are installed on the operating system within 30 days with the following command: softwareupdate_date_epoch=$(/bin/date -j -f "%Y-%m-%d" "$(/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist LastFullSuccessfulDate | /usr/bin/awk '{print $1}')" "+%s") thirty_days_epoch=$(/bin/date -v -30d "+%s") if [[ $softwareupdate_date_epoch -lt $thirty_days_epoch ]]; then /bin/echo "0" else /bin/echo "1" fi If the result is not "1", this is a finding.

Fix

Install the latest updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). https://support.apple.com/en-us/108382 If enrolled in an MDM, consult the MDM's documentation for automated methods.

Our decision

Apply as published

No decision recorded: the recommendation stands. The owner signs in to change it.

All macOS decisions · The macOS baseline · The macOS test plan