AOSX-15-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

800-53|CM-7

CAT|II

CCI|CCI-000056

Rule-ID|SV-225118r610901_rule

STIG-ID|AOSX-15-000001

STIG-Legacy|SV-111613

STIG-Legacy|V-102651

Vuln-ID|V-225118

AOSX-15-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-225119r610901_rule

STIG-ID|AOSX-15-000002

STIG-Legacy|SV-111615

STIG-Legacy|V-102653

Vuln-ID|V-225119

AOSX-15-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-225120r610901_rule

STIG-ID|AOSX-15-000003

STIG-Legacy|SV-111617

STIG-Legacy|V-102655

Vuln-ID|V-225120

AOSX-15-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-225121r610901_rule

STIG-ID|AOSX-15-000004

STIG-Legacy|SV-111619

STIG-Legacy|V-102657

Vuln-ID|V-225121

AOSX-15-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-225122r610901_rule

STIG-ID|AOSX-15-000005

STIG-Legacy|SV-111621

STIG-Legacy|V-102659

Vuln-ID|V-225122

AOSX-15-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CAT|III

CCI|CCI-000060

Rule-ID|SV-225123r610901_rule

STIG-ID|AOSX-15-000006

STIG-Legacy|SV-111623

STIG-Legacy|V-102661

Vuln-ID|V-225123

AOSX-15-000007 - The macOS system must be configured to disable hot corners - bottom left

800-53|AC-11

Rule-ID|SV-225124r610901_rule

STIG-ID|AOSX-15-000007

STIG-Legacy|SV-111625

STIG-Legacy|V-102663

Vuln-ID|V-225124

AOSX-15-000007 - The macOS system must be configured to disable hot corners - bottom right

AOSX-15-000007 - The macOS system must be configured to disable hot corners - top left

AOSX-15-000007 - The macOS system must be configured to disable hot corners - top right

AOSX-15-000008 - The macOS system must be configured with Wi-Fi support software disabled.

800-53|IA-3

CCI|CCI-001443

CCI|CCI-001444

CCI|CCI-001967

Rule-ID|SV-225125r610901_rule

STIG-ID|AOSX-15-000008

STIG-Legacy|SV-111627

STIG-Legacy|V-102665

Vuln-ID|V-225125

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - OpenSSH version

800-53|AC-17

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-225126r610901_rule

STIG-ID|AOSX-15-000011

STIG-Legacy|SV-111629

STIG-Legacy|V-102667

Vuln-ID|V-225126

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD currently running

AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD service disabled

AOSX-15-000012 - The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-225127r610901_rule

STIG-ID|AOSX-15-000012

STIG-Legacy|SV-111631

STIG-Legacy|V-102669

Vuln-ID|V-225127

AOSX-15-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

800-53|AU-8

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-225128r610901_rule

STIG-ID|AOSX-15-000014

STIG-Legacy|SV-111633

STIG-Legacy|V-102671

Vuln-ID|V-225128

AOSX-15-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

800-53|CM-6

AOSX-15-000015 - The macOS system must utilize an HBSS solution and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-225129r610901_rule

STIG-ID|AOSX-15-000015

STIG-Legacy|SV-111635

STIG-Legacy|V-102673

Vuln-ID|V-225129

AOSX-15-000016 - The macOS system must be integrated into a directory services infrastructure.

800-53|IA-2

CAT|I

CCI|CCI-000366

Rule-ID|SV-225130r610901_rule

STIG-ID|AOSX-15-000016

STIG-Legacy|SV-111637

STIG-Legacy|V-102675

Vuln-ID|V-225130

AOSX-15-000020 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user.

800-53|AC-7

CCI|CCI-000044

Rule-ID|SV-225131r610901_rule

STIG-ID|AOSX-15-000020

STIG-Legacy|SV-111639

STIG-Legacy|V-102677

Vuln-ID|V-225131

AOSX-15-000021 - The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.

CCI|CCI-002238

Rule-ID|SV-225132r610901_rule

STIG-ID|AOSX-15-000021

STIG-Legacy|SV-111641

STIG-Legacy|V-102679

Vuln-ID|V-225132

AOSX-15-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked.

Rule-ID|SV-225133r610901_rule

STIG-ID|AOSX-15-000022

STIG-Legacy|SV-111643

STIG-Legacy|V-102681

Vuln-ID|V-225133

AOSX-15-000023 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.

800-53|AC-8

CCI|CCI-000048

Rule-ID|SV-225134r610901_rule

STIG-ID|AOSX-15-000023

STIG-Legacy|SV-111645

STIG-Legacy|V-102683

Vuln-ID|V-225134

AOSX-15-000024 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-225135r610901_rule

STIG-ID|AOSX-15-000024

STIG-Legacy|SV-111647

STIG-Legacy|V-102685

Vuln-ID|V-225135

AOSX-15-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner file

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

CSCv6|3.1

Rule-ID|SV-225136r610901_rule

STIG-ID|AOSX-15-000025

STIG-Legacy|SV-111649

STIG-Legacy|V-102687

Vuln-ID|V-225136

AOSX-15-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system - Banner text

AOSX-15-000030 - The macOS system must be configured so that log files must not contain access control lists (ACLs).

800-53|AU-9

800-53|SI-11

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-225137r610901_rule

STIG-ID|AOSX-15-000030

STIG-Legacy|SV-111651

STIG-Legacy|V-102689

Vuln-ID|V-225137

AOSX-15-000031 - The macOS system must be configured so that log folders must not contain access control lists (ACLs).

Rule-ID|SV-225138r610901_rule

STIG-ID|AOSX-15-000031

STIG-Legacy|SV-111653

STIG-Legacy|V-102691

Vuln-ID|V-225138

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - AuthenticationAuthority

800-53|AC-2

800-53|SC-28

CSCv6|13.2

Rule-ID|SV-225222r610901_rule

STIG-ID|AOSX-15-000032

STIG-Legacy|SV-111655

STIG-Legacy|V-102693

Vuln-ID|V-225222

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - DisableFDEAutologin

AOSX-15-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - FileVault User

AOSX-15-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

800-53|AC-12

CCI|CCI-001133

CSCv6|16.4

Rule-ID|SV-225139r610901_rule

STIG-ID|AOSX-15-000051

STIG-Legacy|SV-111657

STIG-Legacy|V-102695

Detections

Analytics

DISA STIG Apple Mac OSX 10.15 v1r5

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous