BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

os_firmware_password_require Enable Firmware Password

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded macOS

Title

Enable Firmware Password

Control

/usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes"

Discussion

A firmware password _MUST_ be enabled and set.

Single user mode, recovery mode, the Startup Manager, and several other tools are available on macOS by holding the "Option" key down during startup. Setting a firmware password restricts access to these tools.

To set a firmware passcode use the following command:

[source,bash]
----
/usr/sbin/firmwarepasswd -setpasswd
----

NOTE: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through the use of a machine specific binary generated and provided by Apple. Schedule a support call, and provide proof of purchase before the firmware binary will be generated.

NOTE: Firmware passwords are not supported on Apple Silicon devices. This rule is only applicable to Intel devices.

Related controls

ac-6

Fix

NOTE: See discussion on remediation and how to enable firmware password.