NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)

328 requirements · published 2026-01-29
Changes in this version

All Auditing Authentication Password policy Supplemental System Settings iCloud macOS

Controls in this version
Ref	Title	Text
audit_acls_files_configure	Configure Audit Log Files to Not Contain Access Control Lists	/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '{print $1}' \| /usr/bin/grep -c ":"
audit_acls_folders_configure	Configure Audit Log Folder to Not Contain Access Control Lists	/bin/ls -lde /var/audit \| /usr/bin/awk '{print $1}' \| /usr/bin/grep -c ":"
audit_alert_processing_fail	Alert Audit Processing Failure	The technology does not support this requirement. This is an applicable-does not meet finding.
audit_auditd_enabled	Enable Security Auditing	LAUNCHD_RUNNING=$(/bin/launchctl list \| /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c \| /usr/bin/grep -c "AUC_AUDITING") if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING =
audit_configure_capacity_notify	Configure Audit Capacity Warning	/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control
audit_control_acls_configure	Configure Audit_Control to Not Contain Access Control Lists	/bin/ls -le /etc/security/audit_control \| /usr/bin/awk '{print $1}' \| /usr/bin/grep -c ":"
audit_control_group_configure	Configure Audit_Control Group to Wheel	/bin/ls -dn /etc/security/audit_control \| /usr/bin/awk '{print $4}'
audit_control_mode_configure	Configure Audit_Control Owner to Mode 440 or Less Permissive	/bin/ls -l /etc/security/audit_control \| /usr/bin/awk '!/-r--[r-]-----\|current\|total/{print $1}' \| /usr/bin/wc -l \| /usr/bin/xargs
audit_control_owner_configure	Configure Audit_Control Owner to Root	/bin/ls -dn /etc/security/audit_control \| /usr/bin/awk '{print $3}'
audit_enforce_dual_auth	Enforce Dual Authorization for Movement and Deletion of Audit Information	The technology does not support this requirement. This is an applicable-does not meet finding.
audit_failure_halt	Configure System to Shut Down Upon Audit Failure	/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec 'ahlt'
audit_files_group_configure	Configure Audit Log Files Group to Wheel	/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '{s+=$4} END {print s}'
audit_files_mode_configure	Configure Audit Log Files to Mode 440 or Less Permissive	/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '!/-r--r-----\|current\|total/{print $1}' \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
audit_files_owner_configure	Configure Audit Log Files to be Owned by Root	/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '{s+=$3} END {print s}'
audit_flags_aa_configure	Configure System to Audit All Authorization and Authentication Events	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec 'aa'
audit_flags_ad_configure	Configure System to Audit All Administrative Action Events	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec 'ad'
audit_flags_ex_configure	Configure System to Audit All Failed Program Execution on the System	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '\-ex'
audit_flags_fd_configure	Configure System to Audit All Deletions of Object Attributes	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '\-fd'
audit_flags_fm_configure	Configure System to Audit All Changes of Object Attributes	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '^fm'
audit_flags_fm_failed_configure	Configure System to Audit All Failed Change of Object Attributes	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '\-fm'
audit_flags_fr_configure	Configure System to Audit All Failed Read Actions on the System	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '\-fr'
audit_flags_fw_configure	Configure System to Audit All Failed Write Actions on the System	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '\-fw'
audit_flags_lo_configure	Configure System to Audit All Log In and Log Out Events	/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control \| /usr/bin/tr ',' '\n' \| /usr/bin/grep -Ec '^lo'
audit_folder_group_configure	Configure Audit Log Folders Group to Wheel	/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '{print $4}'
audit_folder_owner_configure	Configure Audit Log Folders to be Owned by Root	/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}') \| /usr/bin/awk '{print $3}'
audit_folders_mode_configure	Configure Audit Log Folders to Mode 700 or Less Permissive	/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control \| /usr/bin/awk -F: '{print $2}')
audit_off_load_records	Off-Load Audit Records	The technology does not support this requirement. This is an applicable-does not meet finding.
audit_record_reduction_report_generation	Audit Record Reduction and Report Generation	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
audit_records_processing	Audit Record Reduction and Report Generation	The technology does not support this requirement. This is an applicable-does not meet finding.
audit_retention_configure	Configure Audit Retention to $ODV	/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control
audit_settings_failure_notify	Configure Audit Failure Notification	/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn
auth_pam_login_smartcard_enforce	Enforce Multifactor Authentication for Login	/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so\|auth\s+required\s+pam_deny.so)' /etc/pam.d/login
auth_pam_su_smartcard_enforce	Enforce Multifactor Authentication for the su Command	/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so\|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su
auth_pam_sudo_smartcard_enforce	Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command	/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so\|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo
auth_smartcard_allow	Allow Smartcard Authentication	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('allowSmartCard').js EOS
auth_smartcard_certificate_trust_enforce_high	Set Smartcard Certificate Trust to High	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('checkCertificateTrust').js EOS
auth_smartcard_certificate_trust_enforce_moderate	Set Smartcard Certificate Trust to Moderate	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('checkCertificateTrust').js EOS
auth_smartcard_enforce	Enforce Smartcard Authentication	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('enforceSmartCard').js EOS
auth_ssh_password_authentication_disable	Disable Password Authentication for SSH	/usr/sbin/sshd -G \| /usr/bin/grep -Ec '^(passwordauthentication\s+no\|kbdinteractiveauthentication\s+no)'
icloud_addressbook_disable	Disable iCloud Address Book	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudAddressBook').js EOS
icloud_appleid_system_settings_disable	Disable the System Setting for Apple ID	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings"
icloud_bookmarks_disable	Disable iCloud Bookmarks	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudBookmarks').js EOS
icloud_calendar_disable	Disable the iCloud Calendar Services	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudCalendar').js EOS
icloud_drive_disable	Disable iCloud Document Sync	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudDocumentSync').js EOS
icloud_freeform_disable	Disable the iCloud Freeform Services	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudFreeform').js EOS
icloud_game_center_disable	Disable iCloud Game Center	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGameCenter').js EOS
icloud_keychain_disable	Disable iCloud Keychain Sync	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudKeychainSync').js EOS
icloud_mail_disable	Disable iCloud Mail	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudMail').js EOS
icloud_notes_disable	Disable iCloud Notes	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudNotes').js EOS
icloud_photos_disable	Disable iCloud Photo Library	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudPhotoLibrary').js EOS
icloud_private_relay_disable	Disable iCloud Private Relay	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudPrivateRelay').js EOS
icloud_reminders_disable	Disable iCloud Reminders	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudReminders').js EOS
icloud_sync_disable	Disable iCloud Desktop and Document Folder Sync	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudDesktopAndDocuments').js EOS
os_access_control_mobile_devices	Access Control for Mobile Devices	The technology does not support this requirement. This is an applicable-does not meet finding.
os_account_modification_disable	Disable AppleID and Internet Account Modifications	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAccountModification').js EOS
os_airdrop_disable	Disable AirDrop	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirDrop').js EOS
os_allow_info_passed	Allow Information Transfer with Other Operating Systems	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_anti_virus_installed	Must Use an Approved Antivirus Program	/usr/bin/xprotect status \| /usr/bin/grep -cE "(launch scans: enabled\|background scans: enabled)"
os_appleid_prompt_disable	Disable Apple ID Setup during Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipCloudSetup').js EOS
os_application_sandboxing	Ensure Separate Execution Domain for Processes	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_asl_log_files_owner_group_configure	Configure Apple System Log Files Owned by Root and Group to Wheel	/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* \| /usr/bin/awk '{ print $2 }') 2> /dev/null \| /usr/bin/awk '!/^root:wheel:/{print $1}' \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
os_asl_log_files_permissions_configure	Configure Apple System Log Files To Mode 640 or Less Permissive	/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* \| /usr/bin/awk '{ print $2 }') 2> /dev/null \| /usr/bin/awk '!/640/{print $1}' \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
os_auth_peripherals	Must Authenticate Before Establishing a Connection	The technology does support this requirement, however, third party solutions are required to implement at an infrastructure level.
os_authenticated_root_enable	Enable Authenticated Root	/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null \| /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;"
os_blank_bluray_disable	Disable Blank Blu Ray	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["blankbd"] EOS
os_blank_cd_disable	Disable Blank CD	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["blankcd"] EOS
os_blank_dvd_disable	Disable Blank DVD	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["blankdvd"] EOS
os_bluray_read_only_enforce	Enforce Blu Ray Read Only	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["bd"] EOS
os_bonjour_disable	Disable Bonjour Multicast	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ .objectForKey('NoMulticastAdvertisements').js EOS
os_burn_support_disable	Disable Burn Support	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -Ec '(BurnSupport = off;\|ProhibitBurn = 1;)'
os_calendar_app_disable	Disable Calendar.app	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.allo
os_camera_disable	Disable Camera	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCamera').js EOS
os_cd_read_only_enforce	Enforce CD Read Only	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["cd"] EOS
os_certificate_authority_trust	Issue or Obtain Public Key Certificates from an Approved Service Provider	/usr/bin/security dump-keychain /Library/Keychains/System.keychain \| /usr/bin/awk -F'"' '/labl/ {print $4}'
os_change_security_attributes	Allow Administrators to Modify Security Settings and System Attributes	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_config_data_install_enforce	Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('ConfigDataInstall').js EOS
os_config_profile_ui_install_disable	Disable Installation of Configuration Profiles through the User Interface	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowUIConfigurationProfileInstallation').js EOS
os_continuous_monitoring	Configure Automated Flaw Remediation	The technology does not support this requirement. This is an applicable-does not meet finding.
os_crypto_audit	Protect Audit Integrity with Cryptographic Mechanisms	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_dictation_disable	Disable Dictation	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowDictation').js EOS
os_directory_services_configured	Integrate System into a Directory Services Infrastructure	/usr/bin/dscl localhost -list . \| /usr/bin/grep -qvE '(Contact\|Search\|Local\|^$)'; /bin/echo $?
os_disk_image_disable	Disable Disk Images	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["disk-image"] EOS
os_dvdram_disable	Disable DVD-RAM	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["dvdram"] EOS
os_enforce_access_restrictions	Enforce Access Restrictions	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_erase_content_and_settings_disable	Disable Erase Content and Settings	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowEraseContentAndSettings').js EOS
os_error_message	Generate Error Messages without Exploitable Information	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_ess_installed	Must Use ESS	Ask the System Administrator (SA) or Information System Security Officer (ISSO) if the approved ESS solution is loaded on the system. If the installed components of the ESS solution are not at the DoD approved minimal versions, this is a fi
os_external_storage_access_defined	Access to External Storage Must Be Defined	/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - \| /usr/bin/jq --raw-output '.Restrictions.ExternalStorage'
os_facetime_app_disable	Disable FaceTime.app	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.allo
os_fail_secure_state	Configure System to Fail to a Known Safe State if System Initialization, Shutdown, or Abort Fails	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_filevault_authorized_users	FileVault Authorized Users	/usr/bin/fdesetup list \| /usr/bin/awk -F',' '{print $1}'
os_filevault_autologin_disable	Disable FileVault Automatic Login	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('DisableFDEAutoLogin').js EOS
os_firewall_default_deny_require	Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy	/sbin/pfctl -a '*' -sr &> /dev/null \| /usr/bin/grep -c "block drop in all"
os_firmware_password_require	Enable Firmware Password	/usr/sbin/firmwarepasswd -check \| /usr/bin/grep -c "Password Enabled: Yes"
os_gatekeeper_enable	Enable Gatekeeper	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment').js EOS
os_genmoji_disable	Disable Genmoji AI Creation	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGenmoji').js EOS
os_grant_privs	Allow Administrators to Promote Other Users to Administrator Status	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_guest_folder_removed	Remove Guest Folder if Present	/bin/ls /Users/ \| /usr/bin/grep -c "Guest"
os_handoff_disable	Disable Handoff	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowActivityContinuation').js EOS
os_hibernate_mode_destroyfvkeyonstandby_enable	Enable DestroyFVKeyOnStandby on Hibernate	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('DestroyFVKeyOnStandby').js EOS
os_hibernate_mode_intel_enable	Enable Hibernate Mode (Intel)	error_count=0 if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 \| /usr/bin/grep -q "MacBook"; then hibernateMode=$(/usr/bin/pmset -b -g \| /usr/bin/grep hibernatemode 2>&1 \| /usr/bin/awk '{print $2}') hibernateStandbyLowValue=$(/usr
os_home_folders_default	Configure User's Home Folders to Apple's Default	Verify the macOS system is configured so that permissions are set correctly on user home directories with the following commands: /bin/ls -le /Users This command will return a listing of the permissions of the root of every user account co
os_home_folders_secure	Secure User's Home Folders	/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! $ -perm 700 -o -perm 711 $ \| /usr/bin/grep -v "Shared" \| /usr/bin/grep -v "Guest" \| /usr/bin/wc -l \| /usr/bin/xargs
os_httpd_disable	Disable the Built-in Web Server	result="FAIL" enabled=$(/bin/launchctl print-disabled system \| /usr/bin/grep '"org.apache.httpd" => enabled') running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then result=
os_icloud_storage_prompt_disable	Disable iCloud Storage Setup during Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipiCloudStorageSetup').js EOS
os_identify_non-org_users	Configure the System to Uniquely Identify and Authenticate Non-Organizational Users	This requirement is NA for this technology.
os_image_generation_disable	Disable AI Image Generation	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowImagePlayground').js EOS
os_implement_cryptography	Configure the System to Implement Approved Cryptography to Protect Information	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement using FIPS Validated Cryptographic Modules.
os_implement_memory_protection	Configure the System to Protect Memory from Unauthorized Code Execution	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_information_validation	Information Input Validation	This requirement is NA for this technology.
os_install_log_retention_configure	Configure Install.log Retention to $ODV	/usr/sbin/aslmanager -dd 2>&1 \| /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= $ODV) { ttl="True" }; if ($i == "MAX") {max="True"}}} E
os_iphone_mirroring_disable	Disable iPhone Mirroring	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowiPhoneMirroring').js EOS
os_ir_support_disable	Disable Infrared (IR) support	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ .objectForKey('DeviceEnabled').js EOS
os_isolate_security_functions	Configure the System to Separate User and System Functionality	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_library_validation_enabled	Enable Library Validation	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.libraryvalidation')\ .objectForKey('DisableLibraryValidation').js EOS
os_limit_auditable_events	Only allow authorized users to select auditable events	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_limit_dos_attacks	Limit Impact of Denial of Service Attacks	The technology does not support this requirement. This is an applicable-does not meet finding.
os_limit_gui_sessions	Limit Concurrent GUI Sessions to 10 for all Accounts	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_logical_access	Enforce Approved Authorization for Logical Access	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_loginwindow_adminhostinfo_undefined	Prevent AdminHostInfo from Being Available at LoginWindow	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectIsForcedForKey('AdminHostInfo') EOS
os_logoff_capability_and_message	Display logoff capability and message to prevent exploitation	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_mail_app_disable	Disable Mail App	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.allo
os_mail_smart_reply_disable	Disable Apple Intelligence Mail Smart Replies	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowMailSmartReplies').js EOS
os_mail_summary_disable	Disable Apple Intelligence Mail Summary	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowMailSummary').js EOS
os_malicious_code_prevention	Ensure the System Implements Malicious Code Protection Mechanisms	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_managed_access_control_points	Managed Access Control Points	This requirement is NA for this technology.
os_map_pki_identity	Map identity for PKI based authentication	For directory bound systems, the technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_mdm_require	Enforce Enrollment in Mobile Device Management	/usr/bin/profiles status -type enrollment \| /usr/bin/awk -F: '/MDM enrollment/ {print $2}' \| /usr/bin/grep -c "Yes (User Approved)"
os_messages_app_disable	Disable Messages App	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.allo
os_mfa_network_access	Enforce multifactor authentication for network access to privileged accounts	For directory bound systems: The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_mfa_network_non-priv	Enforce multifactor authentication for network access to non-privileged accounts	For directory bound systems: The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_mobile_file_integrity_enable	Enable Apple Mobile File Integrity	/usr/sbin/nvram -p \| /usr/bin/grep -c "amfi_get_out_of_my_way=1"
os_network_storage_restriction	Network Storage Must Be Restricted	/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - \| /usr/bin/jq --raw-output '.Restrictions.NetworkStorage'
os_newsyslog_files_owner_group_configure	Configure System Log Files Owned by Root and Group to Wheel	/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf \| /usr/bin/awk '{ print $1 }') 2> /dev/null \| /usr/bin/awk '!/^root:wheel:/{print $1}' \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
os_newsyslog_files_permissions_configure	Configure System Log Files to Mode 640 or Less Permissive	/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf \| /usr/bin/awk '{ print $1 }') 2> /dev/null \| /usr/bin/awk '!/640/{print $1}' \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
os_nfsd_disable	Disable Network File System Service	isDisabled=$(/sbin/nfsd status \| /usr/bin/awk '/nfsd service/ {print $NF}') if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then echo "pass" else echo "fail" fi
os_non_repudiation	Non-Repudiation	This requirement is NA for this technology.
os_nonlocal_maintenance	Configure the System for Non-local Maintenance	This requirement is NA for this technology.
os_notes_transcription_disable	Disable Apple Intelligence Notes Transcription	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowNotesTranscription').js EOS
os_notes_transcription_summary_disable	Disable Apple Intelligence Notes Transcription Summary	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowNotesTranscriptionSummary').js EOS
os_notify_account_created	Configure the System to Notify upon Account Created Actions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_notify_account_disabled	Configure the System to Notify upon Account Disabled Actions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_notify_account_enable	Configure the System to Notify upon Account Enabled Actions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_notify_account_modified	Configure the System to Notify upon Account Modified Actions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_notify_account_removal	Configure the System to Notify upon Account Removed Actions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_notify_unauthorized_baseline_change	Configure the System to Notify upon Baseline Configuration Changes	The technology does not support this requirement. This is an applicable-does not meet finding.
os_obscure_password	Obscure Passwords	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_on_device_dictation_enforce	Enforce On Device Dictation	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('forceOnDeviceOnlyDictation').js EOS
os_parental_controls_enable	Enable Parental Controls	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled').js EOS
os_password_autofill_disable	Disable Password Autofill	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowPasswordAutoFill').js EOS
os_password_hint_remove	Remove Password Hint From User Accounts	HINT=$(/usr/bin/dscl . -list /Users hint \| /usr/bin/awk '{ print $2 }') if [ -z "$HINT" ]; then echo "PASS" else echo "FAIL" fi
os_password_proximity_disable	Disable Proximity Based Password Sharing Requests	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowPasswordProximityRequests').js EOS
os_password_sharing_disable	Disable Password Sharing	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowPasswordSharing').js EOS
os_peripherals_identify	The macOS system must uniquely identify peripherals before establishing a connection.	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_photos_enhanced_search_disable	Disable Photos Enhanced Visual Search	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ .objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js EOS
os_pii_deidentification	Remove Elements of Personally Identifiable Information from Datasets	This requirement is NA for this technology.
os_pii_quality_control	Personally Identifiable Information Quality Operations	This requirement is NA for this technology.
os_policy_banner_loginwindow_enforce	Display Policy Banner at Login Window	/bin/ls -ld /Library/Security/PolicyBanner.rtf* \| /usr/bin/wc -l \| /usr/bin/tr -d ' '
os_policy_banner_ssh_configure	Display Policy Banner at Remote Login	bannerText="$ODV" test "$(cat /etc/banner)" = "$bannerText" && echo "1" \|\| echo "0"
os_policy_banner_ssh_enforce	Enforce SSH to Display Policy Banner	/usr/sbin/sshd -G \| /usr/bin/grep -c "^banner /etc/banner"
os_power_nap_disable	Disable Power Nap	/usr/bin/pmset -g custom \| /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}'
os_power_nap_enable	Enable Power Nap	/usr/bin/pmset -g custom \| /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}'
os_predictable_behavior	Must behave in predictable and documented manner	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_prevent_priv_execution	Prevent Software From Executing at Higher Privilege Levels than Users Executing The Software	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_prevent_priv_functions	Configure the System to Block Non-Privileged Users from Executing Privileged Functions	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_prevent_unauthorized_disclosure	Configure the System to Prevent the Unauthorized Disclosure of Data via Shared Resources	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_privacy_principle_minimization	Implement the Privacy Principle of Minimization	This requirement is NA for this technology.
os_privacy_setup_prompt_disable	Disable Privacy Setup Services During Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipPrivacySetup').js EOS
os_prohibit_remote_activation_collab_devices	Prohibit Remote Activation of Collaborative Computing Devices	The technology partially supports this requirement and cannot be configured to be in full compliance.
os_protect_dos_attacks	Protect Against Denial of Service Attacks by Ensuring Rate-Limiting Measures on Network Interfaces	The technology does not support this requirement. This is an applicable-does not meet finding.
os_provide_automated_account_management	Employ Automated Mechanisms for Account Management Functions	The technology does not support this requirement. This is an applicable-does not meet finding.
os_provide_disconnect_remote_access	Provide Ability to Disconnect or Disable Remote Access	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_rapid_security_response_allow	Enforce Rapid Security Response Mechanism	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowRapidSecurityResponseInstallation').js EOS
os_rapid_security_response_removal_disable	Disable User Ability from Being Able to Undo Rapid Security Responses	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowRapidSecurityResponseRemoval').js EOS
os_reauth_devices_change_authenticators	Require Devices to Reauthenticate when Changing Authenticators	The technology does not support this requirement. This is an applicable-does not meet finding.
os_reauth_privilege	Require users to reauthenticate for privilege escalation	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_reauth_users_change_authenticators	Require users to reauthenticate when changing authenticators	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_recovery_lock_enable	Enable Recovery Lock	/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null \| /usr/bin/grep -c "IsRecoveryLockEnabled = 1"
os_remote_access_methods	Control remote access methods	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_removable_media_disable	Disable Removable Storage Devices	/usr/bin/osascript -l JavaScript << EOS ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ .objectForKey('mount-controls'))["harddisk-external"] EOS
os_remove_software_components_after_updates	Must remove all software components after updated versions installed	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_required_crypto_module	Ensure all Federal Laws, Executive Orders, Directives, Policies, Regulations, Standards, and Guidance for Authentication to a Cryptographic Module are Met	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_root_disable	Disable Root Login	/usr/bin/dscl . -read /Users/root UserShell 2>&1 \| /usr/bin/grep -c "/usr/bin/false"
os_safari_advertising_privacy_protection_enable	Ensure Advertising Privacy Protection in Safari Is Enabled	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_safari_open_safe_downloads_disable	Disable Automatic Opening of Safe Files in Safari	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_safari_prevent_cross-site_tracking_enable	Ensure Prevent Cross-site Tracking in Safari Is Enabled	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1\|"WebKitStorageBlockingPolicy" = 1\|"BlockStoragePolicy" =2' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_safari_reader_summary_disable	Disable Apple Intelligence Safari Reader Summary	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowSafariSummary').js EOS
os_safari_show_full_website_address_enable	Ensure Show Full Website Address in Safari Is Enabled	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_safari_show_status_bar_enabled	Ensure Show Safari shows the Status Bar is Enabled	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -c 'ShowOverlayStatusBar = 1' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_safari_warn_fraudulent_website_enable	Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' \| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
os_screensaver_loginwindow_enforce	Enforce Screen Saver at Login Window	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('moduleName').js EOS
os_screensaver_timeout_loginwindow_enforce	Enforce Screen Saver Timeout at LoginWindow	/usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('loginWindowIdleTime')) if ( timeout <= $ODV ) { return("true") }
os_secure_boot_verify	Ensure Secure Boot Level Set to Full	/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null \| /usr/bin/grep -c "SecureBootLevel = full"
os_secure_enclave	Protected Storage for Cryptographic Keys	/usr/sbin/ioreg -w 0 -c AppleSEPManager \| /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $?
os_secure_name_resolution	Secure Name Address Resolution Service	The technology does not support this requirement. This is an applicable-does not meet finding.
os_separate_functionality	Configure the System to Separate User and System Functionality	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_setup_assistant_filevault_enforce	Enforce FileVault in Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ .objectForKey('ForceEnableInSetupAssistant') EOS
os_show_filename_extensions_enable	Enable Show All Filename Extensions	/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults read .GlobalPreferences AppleShowAllExtensions 2>/dev/null
os_sip_enable	Ensure System Integrity Protection is Enabled	/usr/bin/csrutil status \| /usr/bin/grep -c 'System Integrity Protection status: enabled.'
os_siri_prompt_disable	Disable Siri Setup during Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipSiriSetup').js EOS
os_skip_screen_time_prompt_enable	Disable Screen Time Prompt During Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipScreenTime').js EOS
os_skip_unlock_with_watch_enable	Disable Unlock with Apple Watch During Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipUnlockWithWatch').js EOS
os_sleep_and_display_sleep_apple_silicon_enable	Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices	error_count=0 if /usr/sbin/system_profiler SPHardwareDataType \| /usr/bin/grep -q "MacBook"; then cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string) if echo "$cpuType" \| grep -q "Apple"; then sleepMode=$(/usr/bin/pmset -b -g \| /
os_software_update_deferral	Ensure Software Update Deferment Is Less Than or Equal to $ODV Days	/usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('enforcedSoftwareUpdateDelay')) \|\| 0 if ( timeout <= $ODV ) {
os_ssh_fips_compliant	Limit SSH to FIPS Compliant Connections	fips_ssh_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms [email protected],sk-ecdsa-sha2-nistp256-cert-v01@openssh
os_ssh_server_alive_count_max_configure	Set SSH Active Server Alive Maximum to $ODV	ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID \| /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . \| /usr/bin/grep -c "^serveralivecountmax $ODV") if [[ "$sshCheck" == "0" ]]; then
os_ssh_server_alive_interval_configure	Configure SSH ServerAliveInterval option set to $ODV	ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID \| /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . \| /usr/bin/grep -c "^serveraliveinterval $ODV") if [[ "$sshCheck" == "0" ]]; then
os_sshd_channel_timeout_configure	Configure SSHD Channel Timeout to $ODV	/usr/sbin/sshd -G \| /usr/bin/awk '/channeltimeout/{print $2}'
os_sshd_client_alive_count_max_configure	Configure SSHD ClientAliveCountMax to $ODV	/usr/sbin/sshd -G \| /usr/bin/awk '/clientalivecountmax/{print $2}'
os_sshd_client_alive_interval_configure	Configure SSHD ClientAliveInterval to $ODV	/usr/sbin/sshd -G \| /usr/bin/awk '/clientaliveinterval/{print $2}'
os_sshd_fips_compliant	Limit SSHD to FIPS Compliant Connections	fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms [email protected],sk-ecdsa-sha2-nistp256-cert-v01@openss
os_sshd_login_grace_time_configure	Set Login Grace Time to $ODV	/usr/sbin/sshd -G \| /usr/bin/awk '/logingracetime/{print $2}'
os_sshd_per_source_penalties_configure	Configure SSHD PerSourcePenalties	/usr/sbin/sshd -G \| /usr/bin/grep -q "persourcepenalties no" && echo "no" \|\| echo "yes"
os_sshd_permit_root_login_configure	Disable Root Login for SSH	/usr/sbin/sshd -G \| /usr/bin/awk '/permitrootlogin/{print $2}'
os_sshd_unused_connection_timeout_configure	Configure SSHD Unused Connection Timeout to $ODV	/usr/sbin/sshd -G \| /usr/bin/awk '/unusedconnectiontimeout/{print $2}'
os_store_encrypted_passwords	Encrypt Stored Passwords	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_sudo_log_enforce	Configure Sudo To Log Events	/usr/bin/sudo /usr/bin/sudo -V \| /usr/bin/grep -c "Log when a command is allowed by sudoers"
os_sudo_timeout_configure	Configure Sudo Timeout Period to $ODV	/usr/bin/sudo /usr/bin/sudo -V \| /usr/bin/grep -c "Authentication timestamp timeout: $ODV.0 minutes"
os_sudoers_timestamp_type_configure	Configure Sudoers Timestamp Type	/usr/bin/sudo /usr/bin/sudo -V \| /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}'
os_system_read_only	Ensure System Volume is Read Only	/usr/sbin/system_profiler SPStorageDataType \| /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}'
os_system_wide_applications_configure	Ensure Appropriate Permissions Are Enabled for System Wide Applications	/usr/bin/find /Applications -iname "*\.app" -type d -perm -2 -ls \| /usr/bin/wc -l \| /usr/bin/xargs
os_terminal_secure_keyboard_enable	Ensure Secure Keyboard Entry Terminal.app is Enabled	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ .objectForKey('SecureKeyboardEntry').js EOS
os_terminate_session	Terminate all sessions and network connections when maintenance is completed	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_tftpd_disable	Disable Trivial File Transfer Protocol Service	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.apple.tftpd" => disabled'
os_time_offset_limit_configure	Ensure Time Offset Within Limits	/usr/bin/sntp $(/usr/sbin/systemsetup -getnetworktimeserver \| /usr/bin/awk '{print $4}') \| /usr/bin/awk -F'.' '/\+\/\-/{if (substr($1,2) >= 270) {print "No"} else {print "Yes"}}'
os_time_server_enabled	Enable Time Synchronization Daemon	/bin/launchctl list \| /usr/bin/grep -c com.apple.timed
os_touchid_prompt_disable	Disable TouchID Prompt during Setup Assistant	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipTouchIDSetup').js EOS
os_unique_identification	Uniquely Identify Users and Processes	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_unlock_active_user_session_disable	Disable Login to Other User's Active and Locked Sessions	RESULT="FAIL" SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 \| /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) if [[ "${SS_RULE}" == "$ODV" ]]; then RESUL
os_user_app_installation_prohibit	Prohibit User Installation of Software into /Users/	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.allo
os_uucp_disable	Disable Unix-to-Unix Copy Protocol Service	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.apple.uucp" => disabled'
os_verify_remote_disconnection	Verify remote disconnection of sessions	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
os_world_writable_library_folder_configure	Ensure No World Writable Files Exist in the Library Folder	/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null \| /usr/bin/wc -l \| /usr/bin/xargs
os_world_writable_system_folder_configure	Ensure No World Writable Files Exist in the System Folder	/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls \| /usr/bin/grep -vE "downloadDir\|locks" \| /usr/bin/wc -l \| /usr/bin/xargs
os_writing_tools_disable	Disable Apple Intelligence Writing Tools	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowWritingTools').js EOS
pwpolicy_50_percent	Require a Minimum of Fifty Percent Character Change in New Passwords	The technology does not support this requirement. This is an applicable-does not meet finding.
pwpolicy_account_inactivity_enforce	Disable Accounts after $ODV Days of Inactivity	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' -
pwpolicy_account_lockout_enforce	Limit Consecutive Failed Login Attempts to $ODV	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - \| /usr/bin/awk '{ if ($1 <= $ODV) {pr
pwpolicy_account_lockout_timeout_enforce	Set Account Lockout Time to $ODV Minutes	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - \| /usr/bin/awk '{ if ($1/60 >= $ODV ) {print "pass"} else {pr
pwpolicy_alpha_numeric_enforce	Require Passwords Contain a Minimum of One Numeric Character	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - \| /usr/bin/grep "requireAlphanumeric" -c
pwpolicy_custom_regex_enforce	Require Passwords to Match the Defined Custom Regular Expression	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''$ODV'\''")])' -
pwpolicy_emergency_accounts_disable	Automatically Remove or Disable Emergency Accounts within 72 Hours	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
pwpolicy_force_password_change	Force Password Change at Next Logon	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
pwpolicy_history_enforce	Prohibit Password Reuse for a Minimum of $ODV Generations	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - \| /usr/bin/awk '{ if ($1 >= $ODV ) {print "pass"} e
pwpolicy_lower_case_character_enforce	Require Passwords Contain a Minimum of One Lowercase Character	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - \| /usr/bin/awk '{ if ($1 >= $ODV ) {print "pass"}
pwpolicy_max_lifetime_enforce	Restrict Maximum Password Lifetime to $ODV Days	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - \| /usr/bin/awk '{ if ($1 <= $ODV ) {print "pass"} else
pwpolicy_minimum_length_enforce	Require a Minimum Password Length of $ODV Characters	/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null \| tail +2 \| grep -oE "policyAttributePassword matches '.\{[0-9]+," \| awk -F'[{,]' -v ODV=$ODV '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}'
pwpolicy_minimum_lifetime_enforce	Set Minimum Password Lifetime to $ODV Hours	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - \| /usr/bin/awk '{ if ($1 >= $ODV ) {print "pa
pwpolicy_prevent_dictionary_words	Prevent the Use of Dictionary Words for Passwords	For systems not requiring mandatory smart card authentication or those that are not bound to a directory, the technology does not support this requirement. This is an applicable-does not meet finding.
pwpolicy_simple_sequence_disable	Prohibit Repeating, Ascending, and Descending Character Sequences	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - \| /usr/bin/grep "allowSimple" -c
pwpolicy_special_character_enforce	Require Passwords Contain a Minimum of One Special Character	/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null \| /usr/bin/tail -n +2 \| /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.[^a-zA-Z0-9].){\")]" - 2>/dev/null \| /usr/bin/awk -F"{\|}" '{if ($2 >= $ODV)
pwpolicy_temporary_accounts_disable	Automatically Remove or Disable Temporary User Accounts within 72 Hours	The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
pwpolicy_temporary_or_emergency_accounts_disable	Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours	Verify if a password policy is enforced by a directory service by asking the System Administrator (SA) or Information System Security Officer (ISSO). If no policy is enforced by a directory service, a password policy can be set with the "p
pwpolicy_upper_case_character_enforce	Require Passwords Contain a Minimum of One Uppercase Character	/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null \| /usr/bin/tail +2 \| /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - \| /usr/bin/awk '{ if ($1 >= $ODV ) {print "pass"}
supplemental_cis_manual	CIS Manual Recommendations	List of CIS recommendations that are manual check in the CIS macOS Benchmark. [cols="15%h, 85%a"] \|=== \|Section \|System Settings \|Recommendations \|2.1.1.1 Audit iCloud Keychain + 2.1.1.2 Audit iCloud Drive + 2.1.1.4 Audit Security Keys Us
supplemental_controls	Out of Scope Supplemental	There are several requirements defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and Organizations, Revision 5 that can be met by making c
supplemental_filevault	FileVault Supplemental	The supplemental guidance found in this section is applicable for the following rules: * system_settings_filevault_enforce In macOS the internal Apple File System (APFS) data volume can be protected by FileVault. The system volume is alw
supplemental_firewall_pf	Packet Filter (pf) Supplemental	The supplemental guidance found in this section is applicable for the following rules: * os_firewall_default_deny_require macOS contains an application layer firewall (ALF) and a packet filter (PF) firewall. * The ALF can block incomin
supplemental_password_policy	Password Policy Supplemental	To comply with Executive Order 14028, “Improving the Nation's Cybersecurity”, OMB M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, and NIST SP-800-63b, “Digital Identity Guidelines: Authentication and Lifecy
supplemental_smartcard	Smartcard Supplemental	The supplemental guidance found in this section is applicable for the following rules: * auth_ssh_password_authentication_disable * auth_smartcard_enforce * auth_smartcard_certificate_trust_enforce_moderate * auth_smartcard_certifi
system_settings_airplay_receiver_disable	Disable Airplay Receiver	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirPlayIncomingRequests').js EOS
system_settings_apple_watch_unlock_disable	Prevent Apple Watch from Terminating a Session Lock	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAutoUnlock').js EOS
system_settings_automatic_login_disable	Disable Unattended or Automatic Logon to the System	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js EOS
system_settings_automatic_logout_enforce	Enforce Auto Logout After $ODV Seconds of Inactivity	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ .objectForKey('com.apple.autologout.AutoLogOutDelay').js EOS
system_settings_bluetooth_disable	Disable Bluetooth When no Approved Device is Connected	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ .objectForKey('DisableBluetooth').js EOS
system_settings_bluetooth_menu_enable	Enable Bluetooth Menu	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ .objectForKey('Bluetooth').js EOS
system_settings_bluetooth_settings_disable	Disable the Bluetooth System Settings Pane	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c com.apple.BluetoothSettings
system_settings_bluetooth_sharing_disable	Disable Bluetooth Sharing	/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled
system_settings_content_caching_disable	Disable Content Caching Service	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowContentCaching').js EOS
system_settings_critical_update_install_enforce	Enforce Critical Security Updates to be Installed	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('CriticalUpdateInstall').js EOS
system_settings_diagnostics_reports_disable	Disable Sending Diagnostic and Usage Data to Apple	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ .objectForKey('AutoSubmit').js let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applic
system_settings_external_intelligence_disable	Disable External Intelligence Integrations	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowExternalIntelligenceIntegrations').js EOS
system_settings_external_intelligence_sign_in_disable	Disable External Intelligence Integration Sign In	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowExternalIntelligenceIntegrationsSignIn').js EOS
system_settings_filevault_enforce	Enforce FileVault	dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable').js EOS ) fileVault=$(/usr/bin/fdesetup status \| /usr/bin/grep -c "FileVault is On.")
system_settings_find_my_disable	Disable Find My Service	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowFindMyDevice')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc
system_settings_firewall_enable	Enable macOS Application Firewall	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ .objectForKey('EnableFirewall').js EOS
system_settings_firewall_stealth_mode_enable	Enable Firewall Stealth Mode	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ .objectForKey('EnableStealthMode').js EOS
system_settings_gatekeeper_identified_developers_allowed	Apply Gatekeeper Settings to Block Applications from Unidentified Developers	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('AllowIdentifiedDevelopers')) let pref2 = ObjC.unwrap($.NSUserDef
system_settings_gatekeeper_override_disallow	Configure Gatekeeper to Disallow End User Override	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ .objectForKey('DisableOverride').js EOS
system_settings_guest_access_smb_disable	Disable Guest Access to Shared SMB Folders	/usr/bin/defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess
system_settings_guest_account_disable	Disable the Guest Account	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('DisableGuestAccount')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSui
system_settings_hot_corners_disable	Disable Hot Corners	/usr/bin/profiles -P -o stdout \| /usr/bin/grep -Ec '"wvous-bl-corner" = 0\|"wvous-br-corner" = 0\|"wvous-tl-corner" = 0\|"wvous-tr-corner" = 0'
system_settings_hot_corners_secure	Secure Hot Corners	bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev
system_settings_improve_assistive_voice_disable	Disable Sending Audio Recordings and Transcripts to Apple	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ .objectForKey('AXSAudioDonationSiriImprovementEnabled').js EOS
system_settings_improve_search_disable	Disable Improve Search Information to Apple	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .objectForKey('Search Queries Data Sharing Status').js EOS
system_settings_improve_siri_dictation_disable	Disable Improve Siri and Dictation Information to Apple	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .objectForKey('Siri Data Sharing Opt-In Status').js EOS
system_settings_install_macos_updates_enforce	Enforce macOS Updates are Automatically Installed	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('AutomaticallyInstallMacOSUpdates').js EOS
system_settings_internet_accounts_disable	Disable the Internet Accounts System Preference Pane	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension
system_settings_internet_sharing_disable	Disable Internet Sharing	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('forceInternetSharingOff').js EOS
system_settings_location_services_disable	Disable Location Services	/usr/bin/sudo -u _locationd /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.locationd')\ .objectForKey('LocationServicesEnabled').js EOS
system_settings_location_services_enable	Enable Location Services	/usr/bin/sudo -u _locationd /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.locationd')\ .objectForKey('LocationServicesEnabled').js EOS
system_settings_location_services_menu_enforce	Ensure Location Services Is In the Menu Bar	/usr/bin/defaults read /Library/Preferences/com.apple.locationmenu.plist ShowSystemServices
system_settings_loginwindow_loginwindowtext_enable	Configure Login Window to Show A Custom Message	/usr/bin/osascript -l JavaScript << EOS \| /usr/bin/base64 $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('LoginwindowText').js EOS
system_settings_loginwindow_prompt_username_password_enforce	Configure Login Window to Prompt for Username and Password	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('SHOWFULLNAME').js EOS
system_settings_media_sharing_disabled	Disable Media Sharing	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowMediaSharing')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc
system_settings_password_hints_disable	Disable Password Hints	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('RetriesUntilHint').js EOS
system_settings_personalized_advertising_disable	Disable Personalized Advertising	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowApplePersonalizedAdvertising').js EOS
system_settings_printer_sharing_disable	Disable Printer Sharing	/usr/sbin/cupsctl \| /usr/bin/grep -c "_share_printers=0"
system_settings_rae_disable	Disable Remote Apple Events	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.apple.AEServer" => disabled'
system_settings_remote_management_disable	Disable Remote Management	/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null \| /usr/bin/grep -c "RemoteDesktopEnabled = 0"
system_settings_screen_sharing_disable	Disable Screen Sharing and Apple Remote Desktop	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.apple.screensharing" => disabled'
system_settings_screensaver_ask_for_password_delay_enforce	Enforce Session Lock After Screen Saver is Started	/usr/bin/osascript -l JavaScript << EOS function run() { let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('askForPasswordDelay')) if ( delay <= $ODV ) { return("true") } else
system_settings_screensaver_password_enforce	Enforce Screen Saver Password	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('askForPassword').js EOS
system_settings_screensaver_timeout_enforce	Enforce Screen Saver Timeout	/usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('idleTime')) if ( timeout <= $ODV ) { return("true") } else {
system_settings_siri_disable	Disable Siri	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAssistant').js EOS
system_settings_siri_listen_disable	Ensure Siri Listen For is Disabled	/usr/bin/sudo /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Siri')\ .objectForKey('VoiceTriggerUserEnabled').js EOS
system_settings_siri_settings_disable	Disable the System Settings Pane for Siri	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c com.apple.Siri-Settings.extension
system_settings_smbd_disable	Disable Server Message Block Sharing	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.apple.smbd" => disabled'
system_settings_software_update_app_update_enforce	Enforce Software Update App Update Updates Automatically	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('AutomaticallyInstallAppUpdates').js EOS
system_settings_software_update_download_enforce	Enforce Software Update Downloads Updates Automatically	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('AutomaticDownload').js EOS
system_settings_software_update_enforce	Enforce Software Update Automatically	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('AutomaticCheckEnabled').js EOS
system_settings_softwareupdate_current	Ensure Software Update is Updated and Current	softwareupdate_date_epoch=$(/bin/date -j -f "%Y-%m-%d" "$(/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist LastFullSuccessfulDate \| /usr/bin/awk '{print $1}')" "+%s") thirty_days_epoch=$(/bin/date -v -30d "+%s") if
system_settings_ssh_disable	Disable SSH Server for Remote Access Sessions	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.openssh.sshd" => disabled'
system_settings_ssh_enable	Enable SSH Server for Remote Access Sessions	/bin/launchctl print-disabled system \| /usr/bin/grep -c '"com.openssh.sshd" => enabled'
system_settings_system_wide_preferences_configure	Require Administrator Password to Modify System-Wide Preferences	authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.
system_settings_time_machine_auto_backup_enable	Configure Time Machine for Automatic Backups	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.TimeMachine')\ .objectForKey('AutoBackup').js EOS
system_settings_time_machine_encrypted_configure	Ensure Time Machine Volumes are Encrypted	/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist \| grep -c NotEncrypted
system_settings_time_server_configure	Configure macOS to Use an Authorized Time Server	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('timeServer').js EOS
system_settings_time_server_enforce	Enforce macOS Time Synchronization	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ .objectForKey('TMAutomaticTimeOnlyEnabled').js EOS
system_settings_token_removal_enforce	Configure User Session Lock When a Smart Token is Removed	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('tokenRemovalAction').js EOS
system_settings_touch_id_settings_disable	Disable the Touch ID System Settings Pane	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension"
system_settings_touchid_unlock_disable	Disable TouchID for Unlocking the Device	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowFingerprintForUnlock').js EOS
system_settings_usb_restricted_mode	USB Devices Must be Authorized Before Allowing	/usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowUSBRestrictedMode')) if ( pref1 == false ) { ret
system_settings_wake_network_access_disable	Ensure Wake for Network Access Is Disabled	/usr/bin/pmset -g custom \| /usr/bin/awk '/womp/ { sum+=$2 } END {print sum}'
system_settings_wallet_applepay_settings_disable	Disable the System Settings Pane for Wallet and Apple Pay	/usr/bin/profiles show -output stdout-xml \| /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - \| /usr/bin/grep -c "com.apple.WalletSettingsExtension"
system_settings_wifi_disable	Disable Wi-Fi Interface	/usr/sbin/networksetup -listallnetworkservices \| /usr/bin/grep -c "*Wi-Fi"
system_settings_wifi_disable_when_connected_to_ethernet	Disable Wi-Fi When Connected to Ethernet	The technology does not support this requirement. This is an applicable-does not meet finding.
system_settings_wifi_menu_enable	Enable Wifi Menu	/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ .objectForKey('WiFi').js EOS

328 of 328.