AOSX-15-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

800-53|CM-7

CAT|II

CCI|CCI-000056

Rule-ID|SV-225118r610901_rule

STIG-ID|AOSX-15-000001

STIG-Legacy|SV-111613

STIG-Legacy|V-102651

Vuln-ID|V-225118

AOSX-15-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-225119r610901_rule

STIG-ID|AOSX-15-000002

STIG-Legacy|SV-111615

STIG-Legacy|V-102653

Vuln-ID|V-225119

AOSX-15-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-225120r610901_rule

STIG-ID|AOSX-15-000003

STIG-Legacy|SV-111617

STIG-Legacy|V-102655

Vuln-ID|V-225120

AOSX-15-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-225121r610901_rule

STIG-ID|AOSX-15-000004

STIG-Legacy|SV-111619

STIG-Legacy|V-102657

Vuln-ID|V-225121

AOSX-15-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-225122r610901_rule

STIG-ID|AOSX-15-000005

STIG-Legacy|SV-111621

STIG-Legacy|V-102659

Vuln-ID|V-225122

AOSX-15-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CAT|III

CCI|CCI-000060

Rule-ID|SV-225123r610901_rule

STIG-ID|AOSX-15-000006

STIG-Legacy|SV-111623

STIG-Legacy|V-102661

Vuln-ID|V-225123

AOSX-15-000007 - The macOS system must be configured to disable hot corners - bottom left

800-53|AC-11

Rule-ID|SV-225124r610901_rule

STIG-ID|AOSX-15-000007

STIG-Legacy|SV-111625

STIG-Legacy|V-102663

Vuln-ID|V-225124

AOSX-15-000007 - The macOS system must be configured to disable hot corners - bottom right

AOSX-15-000007 - The macOS system must be configured to disable hot corners - top left

AOSX-15-000007 - The macOS system must be configured to disable hot corners - top right

AOSX-15-000008 - The macOS system must be configured with Wi-Fi support software disabled.

800-53|IA-3

CCI|CCI-001443

CCI|CCI-001444

CCI|CCI-001967

Rule-ID|SV-225125r610901_rule

STIG-ID|AOSX-15-000008

STIG-Legacy|SV-111627

STIG-Legacy|V-102665

Vuln-ID|V-225125

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - OpenSSH version

800-53|AC-17

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-225126r610901_rule

STIG-ID|AOSX-15-000011

STIG-Legacy|SV-111629

STIG-Legacy|V-102667

Vuln-ID|V-225126

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD currently running

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD service disabled

AOSX-15-000012 - The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-225127r610901_rule

STIG-ID|AOSX-15-000012

STIG-Legacy|SV-111631

STIG-Legacy|V-102669

Vuln-ID|V-225127

AOSX-15-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

800-53|AU-8

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-225128r610901_rule

STIG-ID|AOSX-15-000014

STIG-Legacy|SV-111633

STIG-Legacy|V-102671

Vuln-ID|V-225128

AOSX-15-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

800-53|CM-6

AOSX-15-000015 - The macOS system must utilize an HBSS solution and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-225129r610901_rule

STIG-ID|AOSX-15-000015

STIG-Legacy|SV-111635

STIG-Legacy|V-102673

Vuln-ID|V-225129

AOSX-15-000016 - The macOS system must be integrated into a directory services infrastructure.

800-53|IA-2

CAT|I

CCI|CCI-000366

Rule-ID|SV-225130r610901_rule

STIG-ID|AOSX-15-000016

STIG-Legacy|SV-111637

STIG-Legacy|V-102675

Vuln-ID|V-225130

AOSX-15-000020 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-225131r610901_rule

STIG-ID|AOSX-15-000020

STIG-Legacy|SV-111639

STIG-Legacy|V-102677

Vuln-ID|V-225131

AOSX-15-000021 - The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.

CCI|CCI-002238

Rule-ID|SV-225132r610901_rule

STIG-ID|AOSX-15-000021

STIG-Legacy|SV-111641

STIG-Legacy|V-102679

Vuln-ID|V-225132

AOSX-15-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked.

Rule-ID|SV-225133r610901_rule

STIG-ID|AOSX-15-000022

STIG-Legacy|SV-111643

STIG-Legacy|V-102681

Vuln-ID|V-225133

AOSX-15-000023 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-225134r610901_rule

STIG-ID|AOSX-15-000023

STIG-Legacy|SV-111645

STIG-Legacy|V-102683

Vuln-ID|V-225134

AOSX-15-000024 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-225135r610901_rule

STIG-ID|AOSX-15-000024

STIG-Legacy|SV-111647

STIG-Legacy|V-102685

Vuln-ID|V-225135

AOSX-15-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner file

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

CSCv6|3.1

Rule-ID|SV-225136r610901_rule

STIG-ID|AOSX-15-000025

STIG-Legacy|SV-111649

STIG-Legacy|V-102687

Vuln-ID|V-225136

AOSX-15-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner text

AOSX-15-000030 - The macOS system must be configured so that log files must not contain access control lists (ACLs).

800-53|AU-9

800-53|SI-11

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-225137r610901_rule

STIG-ID|AOSX-15-000030

STIG-Legacy|SV-111651

STIG-Legacy|V-102689

Vuln-ID|V-225137

AOSX-15-000031 - The macOS system must be configured so that log folders must not contain access control lists (ACLs).

Rule-ID|SV-225138r610901_rule

STIG-ID|AOSX-15-000031

STIG-Legacy|SV-111653

STIG-Legacy|V-102691

Vuln-ID|V-225138

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - AuthenticationAuthority

800-53|AC-2

800-53|SC-28

CSCv6|13.2

Rule-ID|SV-225222r610901_rule

STIG-ID|AOSX-15-000032

STIG-Legacy|SV-111655

STIG-Legacy|V-102693

Vuln-ID|V-225222

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - DisableFDEAutologin

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - FileVault User

AOSX-15-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

800-53|AC-12

CCI|CCI-001133

CSCv6|16.4

Rule-ID|SV-225139r610901_rule

STIG-ID|AOSX-15-000051

STIG-Legacy|SV-111657

STIG-Legacy|V-102695

Detections

Analytics

DISA STIG Apple Mac OSX 10.15 v1r3

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Oct 5, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Jun 17, 2021 Miscellaneous Metadata updated. References updated.