BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

os_rapid_security_response_removal_disable Disable User Ability from Being Able to Undo Rapid Security Responses

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded macOS

Title

Disable User Ability from Being Able to Undo Rapid Security Responses

Control

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('allowRapidSecurityResponseRemoval').js
EOS

Discussion

Rapid security response (RSR) mechanism _MUST_ be enabled and the ability for the user to disable RSR _MUST_ be disabled.

Related controls

si-2, si-2.5, si-3

Fix

This is implemented by a Configuration Profile.