AOSX-14-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

800-53|CM-7

CAT|II

CCI|CCI-000056

Rule-ID|SV-209521r610285_rule

STIG-ID|AOSX-14-000001

STIG-Legacy|SV-104925

STIG-Legacy|V-95787

Vuln-ID|V-209521

AOSX-14-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-209522r610285_rule

STIG-ID|AOSX-14-000002

STIG-Legacy|SV-104927

STIG-Legacy|V-95789

Vuln-ID|V-209522

AOSX-14-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-209523r610285_rule

STIG-ID|AOSX-14-000003

STIG-Legacy|SV-104929

STIG-Legacy|V-95791

Vuln-ID|V-209523

AOSX-14-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-209524r610285_rule

STIG-ID|AOSX-14-000004

STIG-Legacy|SV-104931

STIG-Legacy|V-95793

Vuln-ID|V-209524

AOSX-14-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-209525r610285_rule

STIG-ID|AOSX-14-000005

STIG-Legacy|SV-104933

STIG-Legacy|V-95795

Vuln-ID|V-209525

AOSX-14-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CAT|III

CCI|CCI-000060

Rule-ID|SV-209526r610285_rule

STIG-ID|AOSX-14-000006

STIG-Legacy|SV-104935

STIG-Legacy|V-95797

Vuln-ID|V-209526

AOSX-14-000007 - The macOS system must be configured to disable hot corners - bottom left

800-53|AC-11

Rule-ID|SV-209527r610285_rule

STIG-ID|AOSX-14-000007

STIG-Legacy|SV-104937

STIG-Legacy|V-95799

Vuln-ID|V-209527

AOSX-14-000007 - The macOS system must be configured to disable hot corners - bottom right

AOSX-14-000007 - The macOS system must be configured to disable hot corners - top left

AOSX-14-000007 - The macOS system must be configured to disable hot corners - top right

AOSX-14-000008 - The macOS system must be configured with Wi-Fi support software disabled.

800-53|IA-3(1)

CCI|CCI-001443

CCI|CCI-001444

Rule-ID|SV-209528r610285_rule

STIG-ID|AOSX-14-000008

STIG-Legacy|SV-104939

STIG-Legacy|V-95801

Vuln-ID|V-209528

AOSX-14-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission - OpenSSH version

800-53|AC-17(2)

CAT|I

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

Rule-ID|SV-209530r610285_rule

STIG-ID|AOSX-14-000011

STIG-Legacy|SV-104709

STIG-Legacy|V-95377

Vuln-ID|V-209530

AOSX-14-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission - SSHD currently running

AOSX-14-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission - SSHD service disabled

AOSX-14-000012 - The macOS system must automatically remove or disable temporary user accounts after 72 hours.

CCI|CCI-000016

Rule-ID|SV-209531r610285_rule

STIG-ID|AOSX-14-000012

STIG-Legacy|SV-104943

STIG-Legacy|V-95805

Vuln-ID|V-209531

AOSX-14-000013 - The macOS system must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

CCI|CCI-001682

Rule-ID|SV-209532r610285_rule

STIG-ID|AOSX-14-000013

STIG-Legacy|SV-104945

STIG-Legacy|V-95807

Vuln-ID|V-209532

AOSX-14-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

800-53|AU-8(1)

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-209533r610285_rule

STIG-ID|AOSX-14-000014

STIG-Legacy|SV-104947

STIG-Legacy|V-95809

Vuln-ID|V-209533

AOSX-14-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

800-53|CM-6

AOSX-14-000015 - The macOS system must utilize an HBSS solution and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-209534r610285_rule

STIG-ID|AOSX-14-000015

STIG-Legacy|SV-104949

STIG-Legacy|V-95811

Vuln-ID|V-209534

AOSX-14-000016 - The macOS system must be integrated into a directory services infrastructure.

800-53|IA-2

CCI|CCI-000366

Rule-ID|SV-209535r610285_rule

STIG-ID|AOSX-14-000016

STIG-Legacy|SV-104711

STIG-Legacy|V-95385

Vuln-ID|V-209535

AOSX-14-000020 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-209536r610285_rule

STIG-ID|AOSX-14-000020

STIG-Legacy|SV-104951

STIG-Legacy|V-95813

Vuln-ID|V-209536

AOSX-14-000021 - The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.

CCI|CCI-002238

Rule-ID|SV-209537r610285_rule

STIG-ID|AOSX-14-000021

STIG-Legacy|SV-104953

STIG-Legacy|V-95815

Vuln-ID|V-209537

AOSX-14-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked.

Rule-ID|SV-209538r610285_rule

STIG-ID|AOSX-14-000022

STIG-Legacy|SV-104713

STIG-Legacy|V-95393

Vuln-ID|V-209538

AOSX-14-000023 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-209539r610285_rule

STIG-ID|AOSX-14-000023

STIG-Legacy|SV-104955

STIG-Legacy|V-95817

Vuln-ID|V-209539

AOSX-14-000024 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-209540r610285_rule

STIG-ID|AOSX-14-000024

STIG-Legacy|SV-104957

STIG-Legacy|V-95819

Vuln-ID|V-209540

AOSX-14-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner file

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

CSCv6|3.1

Rule-ID|SV-209541r610285_rule

STIG-ID|AOSX-14-000025

STIG-Legacy|SV-104959

STIG-Legacy|V-95821

Vuln-ID|V-209541

AOSX-14-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner text

AOSX-14-000030 - The macOS system must be configured so that log files must not contain access control lists (ACLs).

800-53|AU-9

800-53|SI-11

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-209542r610285_rule

STIG-ID|AOSX-14-000030

STIG-Legacy|SV-104961

STIG-Legacy|V-95823

Vuln-ID|V-209542

AOSX-14-000031 - The macOS system must be configured so that log folders must not contain access control lists (ACLs).

Rule-ID|SV-209543r610285_rule

STIG-ID|AOSX-14-000031

STIG-Legacy|SV-104963

STIG-Legacy|V-95825

Vuln-ID|V-209543

AOSX-14-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - AuthenticationAuthority

800-53|AC-2

CCI|CCI-002143

Rule-ID|SV-225094r610285_rule

STIG-ID|AOSX-14-000032

STIG-Legacy|SV-104735

STIG-Legacy|V-95597

Vuln-ID|V-225094

AOSX-14-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - DisableFDEAutologin

AOSX-14-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - FileVault User

800-53|SC-28(1)

CSCv6|13.2

AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - OpenSSH Version

Detections

Analytics

DISA STIG Apple Mac OSX 10.14 v2r5

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 May 27, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Apr 25, 2022 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG Apple Mac OSX 10.14 v2r5 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Apple Mac OSX 10.14 v2r5