DISA STIG library V1R8
| Ref | Title | Text | |
|---|---|---|---|
| APPL-15-000001 | The macOS system must prevent Apple Watch from terminating a session lock. | Verify the macOS system is configured to prevent Apple Watch from terminating a session lock with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objec | |
| APPL-15-000002 | The macOS system must enforce screen saver password. | Verify the macOS system is configured to prompt users to enter a password to unlock the screen saver with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .obj | |
| APPL-15-000003 | The macOS system must enforce session lock no more than five seconds after screen saver is started. | Verify the macOS system is configured to initiate a session lock within five seconds of the screen saver starting with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let delay = ObjC.unwrap($.NSUserDefaults. | |
| APPL-15-000005 | The macOS system must configure user session lock when a smart token is removed. | Verify the macOS system is configured to lock the user session when a smart token is removed with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .obje | |
| APPL-15-000007 | The macOS system must disable hot corners. | Verify the macOS system is configured to disable hot corners with the following command: /usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' If the res | |
| APPL-15-000009 | The macOS system must prevent AdminHostInfo from being available at LoginWindow. | Verify the macOS system is configured to prevent AdminHostInfo from being available at LoginWindow with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objec | |
| APPL-15-000012 | The macOS system must automatically remove or disable temporary or emergency user accounts within 72 hours. | Verify that a password policy is enforced by a directory service by asking the system administrator (SA) or information system security officer (ISSO). If no policy is enforced by a directory service, a password policy can be set with the " | |
| APPL-15-000014 | The macOS system must enforce time synchronization. | Verify the macOS system is configured to enforce time synchronization with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ .objectForKey('TMAutomaticTimeOnlyEnabled | |
| APPL-15-000022 | The macOS system must limit consecutive failed login attempts to three. | Verify the macOS system is configured to limit consecutive failed login attempts to three with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="polic | |
| APPL-15-000023 | The macOS system must display a policy banner at remote login. | Verify the macOS system is configured to display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the operating system. Verify the operating system has the correct text listed in the "/etc/banner" file w | |
| APPL-15-000024 | The macOS system must enforce SSH to display a policy banner. | Verify the macOS system is configured to display the contents of "/etc/banner" before granting access to the system with the following command: /usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" If the command does not return "1", t | |
| APPL-15-000025 | The macOS system must display the Standard Mandatory DoW Notice and Consent Banner at the login window. | Verify the macOS system is configured to display a policy banner with the following command: /bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the command does not return "1", this is a finding. The ba | |
| APPL-15-000030 | The macOS system must configure audit log files to not contain access control lists (ACLs). | Verify the macOS system is configured without ACLs applied to log files with the following command: /bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep | |
| APPL-15-000031 | The macOS system must configure the audit log folder to not contain access control lists (ACLs). | Verify the macOS system is configured without ACLs applied to log folders with the following command: /bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding. | |
| APPL-15-000033 | The macOS system must disable FileVault automatic login. | Verify the macOS system is configured to disable FileVault automatic login with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('DisableFDEAutoL | |
| APPL-15-000051 | The macOS system must configure SSHD ClientAliveInterval to 900. | Verify the macOS system is configured to set the SSHD ClientAliveInterval to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' If the result is not "900", this is a finding. | |
| APPL-15-000052 | The macOS system must configure SSHD ClientAliveCountMax to 1. | Verify the macOS system is configured to set the SSHD ClientAliveCountMax to 1 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' If the result is not "1", this is a finding. | |
| APPL-15-000053 | The macOS system must set login grace time to 30. | Verify the macOS system is configured to set Login Grace Time to 30 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' If the result is not "30", this is a finding. | |
| APPL-15-000054 | The macOS system must limit SSHD to FIPS-compliant connections. | Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command: fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@o | |
| APPL-15-000057 | The macOS system must limit SSH to FIPS-compliant connections. | Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command: fips_ssh_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@ope | |
| APPL-15-000060 | The macOS system must set account lockout time to 15 minutes. | Verify the macOS system is configured to set account lockout time to 15 minutes with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSec | |
| APPL-15-000070 | The macOS system must enforce screen saver timeout. | Verify the macOS system is configured to initiate the screen saver timeout after 15 minutes of inactivity with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc. | |
| APPL-15-000090 | The macOS system must disable login to other users' active and locked sessions. | Verify the macOS system is configured to disable login to other users' active and locked sessions with the following command: /usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c 'authenticate-session-owne | |
| APPL-15-000100 | The macOS system must disable root login. | Verify the macOS system is configured to disable root login with the following command: /usr/bin/dscl . -read /Users/root UserShell 2>&1 | /usr/bin/grep -c "/usr/bin/false" If the result is not "1", this is a finding. | |
| APPL-15-000110 | The macOS system must configure the SSH ServerAliveInterval to 900. | Verify the macOS system is configured to set the SSH ServerAliveInterval to 900 with the following command: ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u $u | |
| APPL-15-000120 | The macOS system must configure SSHD channel timeout to 900. | Verify the macOS system is configured to set the SSHD Channel Timeout to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk -F "=" '/channeltimeout session:*/{print $2}' If the result is not "900", this is a finding. | |
| APPL-15-000130 | The macOS system must configure SSHD unused connection timeout to 900. | Verify the macOS system is configured to set the SSHD unused connection timeout to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' If the result is not "900", this is a finding. | |
| APPL-15-000140 | The macOS system must set SSH Active Server Alive Maximum to 0. | Verify the macOS system is configured to set SSH Active Server Alive Maximum to 0 with the following command: ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u | |
| APPL-15-000160 | The macOS system must enforce auto logout after 86400 seconds of inactivity. | Verify the macOS system is configured to enforce auto logout after 86400 seconds of inactivity with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ .objectForKey | |
| APPL-15-000170 | The macOS system must be configured to use an authorized time server. | Verify the macOS system is configured to use an authorized time server with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('timeServer').js EOS If the | |
| APPL-15-000180 | The macOS system must enable the time synchronization daemon. | Verify the macOS system is configured to enable the time synchronization daemon with the following command: /bin/launchctl list | /usr/bin/grep -c com.apple.timed If the result is not "1", this is a finding. | |
| APPL-15-000190 | The macOS system must configure sudo to log events. | Verify the macOS system is configured to log privilege escalation with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" If the result is not "1", this is a finding. | |
| APPL-15-001001 | The macOS system must be configured to audit all administrative action events. | Verify the macOS system is configured to audit privileged access with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' If the result is not "1", t | |
| APPL-15-001002 | The macOS system must be configured to audit all login and logout events. | Verify the macOS system is configured to audit all login and logout events with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' If the result is | |
| APPL-15-001003 | The macOS system must enable security auditing. | Verify the macOS system is configured to enable the auditd service with the following command: LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") | |
| APPL-15-001010 | The macOS system must be configured to shut down upon audit failure. | Verify the macOS system is configured to shut down upon audit failure with the following command: /usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' If the result is not | |
| APPL-15-001012 | The macOS system must configure audit log files to be owned by root. | Verify the macOS system is configured with audit log files owned by root with the following command: /bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' If th | |
| APPL-15-001013 | The macOS system must configure audit log folders to be owned by root. | Verify the macOS system is configured with audit log folders owned by root with the following command: /bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' If the result | |
| APPL-15-001014 | The macOS system must configure the audit log files group to wheel. | Verify the macOS system is configured with audit log files group-owned by wheel with the following command: /bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s} | |
| APPL-15-001015 | The macOS system must configure the audit log folders group to wheel. | Verify the macOS system is configured with audit log folders group-owned by wheel with the following command: /bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' If the | |
| APPL-15-001016 | The macOS system must configure audit log files to mode 440 or less permissive. | Verify the macOS system is configured with audit log files set to mode 440 or less with the following command: /bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|curre | |
| APPL-15-001017 | The macOS system must configure audit log folders to mode 700 or less permissive. | Verify the macOS system is configured with audit log folders set to mode 700 or less permissive with the following command: /usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') If the resul | |
| APPL-15-001020 | The macOS system must be configured to audit all deletions of object attributes. | Verify the macOS system is configured to audit all deletions of object attributes with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' If the r | |
| APPL-15-001021 | The macOS system must be configured to audit all changes of object attributes. | Verify the macOS system is configured to audit all changes of object attributes with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm' If the resu | |
| APPL-15-001022 | The macOS system must be configured to audit all failed read actions on the system. | Verify the macOS system is configured to audit all failed read actions on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' If th | |
| APPL-15-001023 | The macOS system must be configured to audit all failed write actions on the system. | Verify the macOS system is configured to audit all failed write actions on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' If t | |
| APPL-15-001024 | The macOS system must be configured to audit all failed program execution on the system. | Verify the macOS system is configured to audit all failed program execution on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' | |
| APPL-15-001029 | The macOS system must configure audit retention to seven days. | Verify the macOS system is configured to set audit retention to seven days with the following command: /usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control If the result is not "7d", this is a finding. | |
| APPL-15-001030 | The macOS system must configure audit capacity warning. | Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control If the result is not "25", thi | |
| APPL-15-001031 | The macOS system must configure audit failure notification. | Verify the macOS system is configured to produce audit failure notification with the following command: /usr/bin/grep -c "logger -s -p" /etc/security/audit_warn If the result is not "1", this is a finding. | |
| APPL-15-001044 | The macOS system must be configured to audit all authorization and authentication events. | Verify the macOS system is configured to audit login events with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' If the result is not "1", this i | |
| APPL-15-001060 | The macOS system must set smart card certificate trust to moderate. | Verify the macOS system is configured to check the revocation status of user certificates with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectF | |
| APPL-15-001100 | The macOS system must disable root login for SSH. | Verify the macOS system is configured to disable root login for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' If the result is not "no", this is a finding. | |
| APPL-15-001110 | The macOS system must configure audit_control group to wheel. | Verify the macOS system is configured with the audit_control group to wheel with the following command: /bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' If the result is not "0", this is a finding. | |
| APPL-15-001120 | The macOS system must configure audit_control owner to root. | Verify the macOS system is configured with the audit_control owner to root with the following command: /bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' If the result is not "0", this is a finding. | |
| APPL-15-001130 | The macOS system must configure audit_control owner to mode 440 or less permissive. | Verify the macOS system is configured with the audit_control to mode 440 or less with the following command: /bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs | |
| APPL-15-001140 | The macOS system must configure audit_control to not contain access control lists (ACLs). | Verify the macOS system is configured without ACLs applied to audit_control with the following command: /bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding. | |
| APPL-15-001150 | The macOS system must disable password authentication for SSH. | Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", | |
| APPL-15-002001 | The macOS system must disable Server Message Block (SMB) sharing. | Verify the macOS system is configured to disable SMB sharing with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002003 | The macOS system must disable Network File System (NFS) service. | Verify the macOS system is configured to disable NFS service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.nfsd" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002004 | The macOS system must disable Location Services. | Verify the macOS system is configured to disable Location Services with the following command: /usr/bin/sudo -u _locationd /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.locationd')\ .objectForKe | |
| APPL-15-002005 | The macOS system must disable Bonjour multicast. | Verify the macOS system is configured to disable Bonjour multicast with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ .objectForKey('NoMulticastAdvertisem | |
| APPL-15-002006 | The macOS system must disable Unix-to-Unix Copy Protocol (UUCP) service. | Verify the macOS system is configured to disable UUCP service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.uucp" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002007 | The macOS system must disable Internet Sharing. | Verify the macOS system is configured to disable Internet Sharing with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('forceInternetSharingOff').js EOS | |
| APPL-15-002008 | The macOS system must disable the built-in web server. | Verify the macOS system is configured to disable the built-in web server with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"org.apache.httpd" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002009 | The macOS system must disable AirDrop. | Verify the macOS system is configured to disable AirDrop with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirDrop').js EOS If th | |
| APPL-15-002010 | The macOS system must disable FaceTime.app. | Verify the macOS system is configured to disable FaceTime.app with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess | |
| APPL-15-002012 | The macOS system must disable the iCloud Calendar services. | Verify the macOS system is configured to disable iCloud Calendar services with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloud | |
| APPL-15-002013 | The macOS system must disable iCloud Reminders. | Verify the macOS system is configured to disable iCloud Reminders with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudReminder | |
| APPL-15-002014 | The macOS system must disable iCloud Address Book. | Verify the macOS system is configured to disable iCloud Address Book with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudAddre | |
| APPL-15-002015 | The macOS system must disable iCloud Mail. | Verify the macOS system is configured to disable iCloud Mail with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudMail').js EOS | |
| APPL-15-002016 | The macOS system must disable iCloud Notes. | Verify the macOS system is configured to disable iCloud Notes with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudNotes').js E | |
| APPL-15-002017 | The macOS system must disable the camera. | If the device or operating system does not have a camera installed, this requirement is not applicable. This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local authorizing offic | |
| APPL-15-002020 | The macOS system must disable Siri. | Verify the macOS system is configured to disable Siri with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAssistant').js EOS If the | |
| APPL-15-002021 | The macOS system must disable sending diagnostic and usage data to Apple. | Verify the macOS system is configured to disable sending diagnostic and usage data to Apple with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple | |
| APPL-15-002022 | The macOS system must disable Remote Apple Events. | Verify the macOS system is configured to disable Remote Apple Events with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002023 | The macOS system must disable sending audio recordings and transcripts to Apple. | Verify the macOS system is configured to disable sending audio recordings and transcripts with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ .objectForKey | |
| APPL-15-002024 | The macOS system must disable sending search data from Spotlight to Apple. | Verify the macOS system is configured to disable sending search data from Spotlight with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .objectForKey(' | |
| APPL-15-002035 | The macOS system must disable Apple ID setup during Setup Assistant. | Verify the macOS system is configured to disable Apple ID setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .object | |
| APPL-15-002036 | The macOS system must disable Privacy Setup services during Setup Assistant. | Verify the macOS system is configured to disable Privacy Setup services during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ | |
| APPL-15-002037 | The macOS system must disable iCloud storage setup during Setup Assistant. | Verify the macOS system is configured to disable iCloud storage setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ . | |
| APPL-15-002038 | The macOS system must disable Trivial File Transfer Protocol (TFTP) service. | Verify the macOS system is configured to disable TFTP service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.tftpd" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002039 | The macOS system must disable Siri Setup during Setup Assistant. | Verify the macOS system is configured to disable Siri Setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForK | |
| APPL-15-002040 | The macOS system must disable iCloud Keychain Sync. | Verify the macOS system is configured to disable iCloud Keychain Sync with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudKeyc | |
| APPL-15-002041 | The macOS system must disable iCloud Document Sync. | Verify the macOS system is configured to disable iCloud Document Sync with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudDocu | |
| APPL-15-002042 | The macOS system must disable iCloud Bookmarks. | Verify the macOS system is configured to disable iCloud Bookmarks with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudBookmark | |
| APPL-15-002043 | The macOS system must disable iCloud Photo Library. | Verify the macOS system is configured to disable the iCloud Photo Library with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloud | |
| APPL-15-002050 | The macOS system must disable Screen Sharing and Apple Remote Desktop. | Verify the macOS system is configured to disable Screen Sharing and Apple Remote Desktop with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.screensharing" => disabled' If the result is not "1", t | |
| APPL-15-002052 | The macOS system must disable the System Settings pane for Wallet and Apple Pay. | Verify the macOS system is configured to disable the System Settings pane for Wallet and Apple Pay with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/foll | |
| APPL-15-002053 | The macOS system must disable the system settings pane for Siri. | Verify the macOS system is configured to disable the system settings pane for Siri with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::* | |
| APPL-15-002060 | The macOS system must apply gatekeeper settings to block applications from unidentified developers. | Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefa | |
| APPL-15-002062 | The macOS system must disable Bluetooth when no approved device is connected. | Verify the macOS system is configured to disable Bluetooth with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ .objectForKey('DisableBluetooth').js EOS If t | |
| APPL-15-002063 | The macOS system must disable the guest account. | Verify the macOS system is configured to disable the guest account with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .obje | |
| APPL-15-002064 | The macOS system must enable gatekeeper. | Verify the macOS system is configured to enable gatekeeper with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment').js | |
| APPL-15-002066 | The macOS system must disable unattended or automatic login to the system. | Verify the macOS system is configured to disable unattended or automatic login to the system with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKe | |
| APPL-15-002068 | The macOS system must secure users' home folders. | Verify the macOS system is configured so that permissions are set correctly on user home directories with the following command: /usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/ | |
| APPL-15-002069 | The macOS system must require an administrator password to modify systemwide preferences. | Verify the macOS system is configured to require administrator privileges to modify systemwide settings with the following command: authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferen | |
| APPL-15-002080 | The macOS system must disable Airplay Receiver. | Verify the macOS system is configured to disable Airplay Receiver with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirPlayIncomi | |
| APPL-15-002090 | The macOS system must disable TouchID for unlocking the device. | Verify the macOS system is configured to disable TouchID for unlocking the device with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('al | |
| APPL-15-002100 | The macOS system must disable Media Sharing. | Verify the macOS system is configured to disable Media Sharing with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationacce | |
| APPL-15-002110 | The macOS system must disable Bluetooth Sharing. | Verify the macOS system is configured to disable Bluetooth sharing with the following commands: CURRENT_USER=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' ) /usr/bin/sudo - | |
| APPL-15-002120 | The macOS system must disable AppleID and internet Account Modification. | Verify the macOS system is configured to disable account modification with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAccountMo | |
| APPL-15-002140 | The macOS system must disable Content Caching service. | Verify the macOS system is configured to disable Content Caching service with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowConten | |
| APPL-15-002150 | The macOS system must disable iCloud Desktop and Document folder sync. | Verify the macOS system is configured to disable iCloud Desktop and Document folder synchronization with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ | |
| APPL-15-002160 | The macOS system must disable iCloud Game Center. | Verify the macOS system is configured to disable iCloud Game Center with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGameCenter' | |
| APPL-15-002170 | The macOS system must disable iCloud Private Relay. | Verify the macOS system is configured to disable the iCloud Private Relay with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloud | |
| APPL-15-002180 | The macOS system must disable Find My service. | Verify the macOS system is configured to disable Find My service with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationacc | |
| APPL-15-002200 | The macOS system must disable Personalized Advertising. | Verify the macOS system is configured to disable Personalized Advertising with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowApple | |
| APPL-15-002210 | The macOS system must disable sending Siri and Dictation information to Apple. | Verify the macOS system is configured to disable sending Siri and Dictation information to Apple with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .o | |
| APPL-15-002220 | The macOS system must enforce On Device Dictation. | For Intel-based systems, this is not applicable. Verify the macOS system is configured to enforce On Device Only Dictation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.app | |
| APPL-15-002230 | The macOS system must disable Dictation. | For Apple Silicon-based systems, this is not applicable. Verify the macOS system is configured to disable Dictation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.appl | |
| APPL-15-002240 | The macOS system must disable Printer Sharing. | Verify the macOS system is configured to disable Printer Sharing with the following command: /usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" If the result is not "1", this is a finding. | |
| APPL-15-002250 | The macOS system must disable Remote Management. | Verify the macOS system is configured to disable Remote Management with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "RemoteDesktopEnabled = 0" If the result is not "1", this is a finding. | |
| APPL-15-002260 | The macOS system must disable the Bluetooth System Settings pane. | Verify the macOS system is configured to disable the Bluetooth System Settings pane with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling:: | |
| APPL-15-002270 | The macOS system must disable the iCloud Freeform services. | Verify the macOS system is configured to disable iCloud Freeform services with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloud | |
| APPL-15-002271 | The macOS system must disable iPhone Mirroring. | Verify the macOS system is configured to disable iPhone Mirroring with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowiPhoneMirrori | |
| APPL-15-003001 | The macOS system must issue or obtain public key certificates from an approved service provider. | Verify the macOS system is configured to issue or obtain public key certificates from an approved service provider with the following command: /usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ { | |
| APPL-15-003007 | The macOS system must require that passwords contain a minimum of one numeric character. | Verify the macOS system is configured to require that passwords contain a minimum of one numeric character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/ | |
| APPL-15-003008 | The macOS system must restrict maximum password lifetime to 180 days. | Verify the macOS system is configured to restrict maximum password lifetime to 180 days with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyA | |
| APPL-15-003010 | The macOS system must require a minimum password length of 14 characters. | Verify the macOS system is configured to enforce a minimum 14-character password length with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text( | |
| APPL-15-003011 | The macOS system must require that passwords contain a minimum of one special character. | Verify the macOS system is configured to require passwords contain a minimum of one special character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[c | |
| APPL-15-003012 | The macOS system must disable password hints. | Verify the macOS system is configured to disable password hints with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('RetriesUntilHint').js EOS | |
| APPL-15-003013 | The macOS system must enable firmware password. | For Apple Silicon systems, this is not applicable. Verify the macOS system is configured with a firmware password with the following command: /usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes" If the result is not "1 | |
| APPL-15-003014 | The macOS system must remove password hints from user accounts. | Verify the macOS system is configured to remove password hints from user accounts with the following command: HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') if [ -z "$HINT" ]; then echo "PASS" else echo "FAIL" fi If | |
| APPL-15-003020 | The macOS system must enforce smart card authentication. | Verify the macOS system is configured to enforce multifactor authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('enforce | |
| APPL-15-003030 | The macOS system must allow smart card authentication. | Verify the macOS system is configured to allow smart card authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('allowSmart | |
| APPL-15-003050 | The macOS system must enforce multifactor authentication for login. | Verify the macOS system is configured to enforce multifactor authentication for login with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login If the result is no | |
| APPL-15-003051 | The macOS system must enforce multifactor authentication for the su command. | Verify the macOS system is configured to enforce multifactor authentication for the su command with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su If the resu | |
| APPL-15-003052 | The macOS system must enforce multifactor authentication for privilege escalation through the sudo command. | Verify the macOS system is configured to enforce multifactor authentication for privilege escalation through the sudo command with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.s | |
| APPL-15-003060 | The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character. | Verify the macOS system is configured to require that passwords contain a minimum of one lowercase character and one uppercase character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /us | |
| APPL-15-003070 | The macOS system must set minimum password lifetime to 24 hours. | Verify the macOS system is configured to set minimum password lifetime to 24 hours with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttrib | |
| APPL-15-003080 | The macOS system must disable accounts after 35 days of inactivity. | Verify the macOS system is configured to disable accounts after 35 days of inactivity with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAtt | |
| APPL-15-004001 | The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel. | Verify the macOS system is configured with ASL files owned by root and group to wheel with the following command: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | / | |
| APPL-15-004002 | The macOS system must configure Apple System Log (ASL) files to mode 640 or less permissive. | Verify the macOS system is configured with ASL files to mode 640 or less permissive with the following command: /usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin | |
| APPL-15-004022 | The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command. | Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes" If the resul | |
| APPL-15-004030 | The macOS system must configure system log files owned by root and group to wheel. | Verify the macOS system is configured with system log files owned by root and group to wheel with the following command: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | | |
| APPL-15-004040 | The macOS system must configure system log files to mode 640 or less permissive. | Verify the macOS system is configured with system log files set to mode 640 or less permissive with the following command: /usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /u | |
| APPL-15-004050 | The macOS system must configure install.log retention to 365. | Verify the macOS system is configured with install.log retention to 365 with the following command: /usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i | |
| APPL-15-004060 | The macOS system must configure sudoers timestamp type. | Verify the macOS system is configured with sudoers timestamp type with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' If the result is not "tty", this is a f | |
| APPL-15-005001 | The macOS system must ensure System Integrity Protection is enabled. | Verify the macOS system is configured to enable System Integrity Protection with the following command: /usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' If the result is not "1", this is a finding. | |
| APPL-15-005020 | The macOS system must enforce FileVault. | Verify the macOS system is configured to enforce FileVault with the following command: dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable' | |
| APPL-15-005050 | The macOS system must enable macOS Application Firewall. | Verify the macOS system is configured to enable the Application Firewall with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ .objectForKey('EnableFirew | |
| APPL-15-005052 | The macOS system must configure the login window to prompt for username and password. | Verify the macOS system is configured to prompt for username and password at the login window with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForK | |
| APPL-15-005054 | The macOS system must disable the TouchID prompt during Setup Assistant. | Verify the macOS system is configured to disable the TouchID prompt during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .ob | |
| APPL-15-005055 | The macOS system must disable the Screen Time prompt during Setup Assistant. | Verify the macOS system is configured to disable the Screen Time prompt during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ | |
| APPL-15-005056 | The macOS system must disable Unlock with Apple Watch during Setup Assistant. | Verify the macOS system is configured to disable Unlock with Apple Watch during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed') | |
| APPL-15-005058 | The macOS system must disable Handoff. | Verify the macOS system is configured to disable Handoff with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowActivityContinuation') | |
| APPL-15-005060 | The macOS system must disable proximity-based password sharing requests. | Verify the macOS system is configured to disable proximity-based password sharing requests with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectF | |
| APPL-15-005061 | The macOS system must disable Erase Content and Settings. | Verify the macOS system is configured to disable Erase Content and Settings with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowEra | |
| APPL-15-005070 | The macOS system must enable Authenticated Root. | Verify the macOS system is configured to enable authenticated root with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;" If the result is not "1", this is a finding. | |
| APPL-15-005080 | The macOS system must prohibit user installation of software into /users/. | Verify the macOS system is configured to prohibit user installation of software into /users/ with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteNa | |
| APPL-15-005090 | The macOS system must authorize USB devices before allowing connection. | Verify the macOS system is configured to authorize USB devices before allowing connection with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName( | |
| APPL-15-005100 | The macOS system must ensure Secure Boot level is set to "full". | Verify the macOS system is configured to ensure Secure Boot level is set to "full" using the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "SecureBootLevel = full" If the result is not "1", this is a finding | |
| APPL-15-005110 | The macOS system must enforce enrollment in Mobile Device Management (MDM). | Verify the macOS system is configured to enforce enrollment in mobile device management with the following command: /usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User App | |
| APPL-15-005120 | The macOS system must enable Recovery Lock. | For non-Apple Silicon systems, this is not applicable. Verify the macOS system is configured with Recovery Lock with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" If the resul | |
| APPL-15-005130 | The macOS system must enforce installation of XProtect Remediator and Gatekeeper updates automatically. | Verify the macOS system is configured to enforce installation of XProtect Remediator and Gatekeeper updates automatically with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.appl | |
| APPL-15-005140 | The macOS system must disable Genmoji. | Verify the macOS system is configured to disable Genmoji with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGenmoji').js EOS If th | |
| APPL-15-005150 | The macOS system must disable Apple Intelligence Image Generation. | Verify the macOS system is configured to disable Apple Intelligence Image Generation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey( | |
| APPL-15-005160 | The macOS system must disable Apple Intelligence Writing Tools. | Verify the macOS system is configured to disable Apple Intelligence Writing Tools with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('al | |
| APPL-15-999999 | The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). | Verify security-relevant software updates are installed on the operating system within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). Click the Apple icon on the menu at the top left c |
160 of 160.