APPL-13-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

CAT|II

CCI|CCI-000056

Rule-ID|SV-257142r905059_rule

STIG-ID|APPL-13-000001

Vuln-ID|V-257142

APPL-13-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-257143r905062_rule

STIG-ID|APPL-13-000002

Vuln-ID|V-257143

APPL-13-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-257144r905065_rule

STIG-ID|APPL-13-000003

Vuln-ID|V-257144

APPL-13-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-257145r905068_rule

STIG-ID|APPL-13-000004

Vuln-ID|V-257145

APPL-13-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-257146r905071_rule

STIG-ID|APPL-13-000005

Vuln-ID|V-257146

APPL-13-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CCI|CCI-000060

Rule-ID|SV-257147r905074_rule

STIG-ID|APPL-13-000006

Vuln-ID|V-257147

APPL-13-000007 - The macOS system must be configured to disable hot corners - bottom left

Rule-ID|SV-257148r905077_rule

STIG-ID|APPL-13-000007

Vuln-ID|V-257148

APPL-13-000007 - The macOS system must be configured to disable hot corners - bottom right

APPL-13-000007 - The macOS system must be configured to disable hot corners - top left

APPL-13-000007 - The macOS system must be configured to disable hot corners - top right

APPL-13-000011 - The macOS system must disable the SSHD service.

CAT|I

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-001967

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-257149r905080_rule

STIG-ID|APPL-13-000011

Vuln-ID|V-257149

APPL-13-000012 - The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-257150r905083_rule

STIG-ID|APPL-13-000012

Vuln-ID|V-257150

APPL-13-000014 - The macOS system must compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-257151r905086_rule

STIG-ID|APPL-13-000014

Vuln-ID|V-257151

APPL-13-000014 - The macOS system must compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

APPL-13-000015 - The macOS system must use an Endpoint Security Solution (ESS) and implement all DOD required modules - ESS and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-257152r905089_rule

STIG-ID|APPL-13-000015

Vuln-ID|V-257152

APPL-13-000016 - The macOS system must be integrated into a directory services infrastructure.

CCI|CCI-000366

Rule-ID|SV-257153r905092_rule

STIG-ID|APPL-13-000016

Vuln-ID|V-257153

APPL-13-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - maxFailedAttempts

CCI|CCI-002238

Rule-ID|SV-257154r905095_rule

STIG-ID|APPL-13-000022

Vuln-ID|V-257154

APPL-13-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - minutesUntilFailedLoginReset

APPL-13-000023 - The macOS system must display the Standard Mandatory DOD Notice and Consent Banner before granting remote access to the operating system.

CCI|CCI-000048

Rule-ID|SV-257155r905098_rule

STIG-ID|APPL-13-000023

Vuln-ID|V-257155

APPL-13-000024 - The macOS system must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-257156r905101_rule

STIG-ID|APPL-13-000024

Vuln-ID|V-257156

APPL-13-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DOD Notice and Consent Banner before granting GUI access to the system.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-257157r905104_rule

STIG-ID|APPL-13-000025

Vuln-ID|V-257157

APPL-13-000030 - The macOS system must be configured so that log files do not contain access control lists (ACLs) - ACLs.

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-257158r905107_rule

STIG-ID|APPL-13-000030

Vuln-ID|V-257158

APPL-13-000031 - The macOS system must be configured so that log folders do not contain access control lists (ACLs) - ACLs.

Rule-ID|SV-257159r905110_rule

STIG-ID|APPL-13-000031

Vuln-ID|V-257159

APPL-13-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - UserShell

Rule-ID|SV-257160r905113_rule

STIG-ID|APPL-13-000032

Vuln-ID|V-257160

APPL-13-000033 - The macOS system must be configured to disable password forwarding for FileVault.

Rule-ID|SV-257161r905116_rule

STIG-ID|APPL-13-000033

Vuln-ID|V-257161

APPL-13-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

CCI|CCI-001133

Rule-ID|SV-257162r905119_rule

STIG-ID|APPL-13-000051

Vuln-ID|V-257162

APPL-13-000052 - The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 1.

Rule-ID|SV-257163r905122_rule

STIG-ID|APPL-13-000052

Vuln-ID|V-257163

APPL-13-000053 - The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.

Rule-ID|SV-257164r905125_rule

STIG-ID|APPL-13-000053

Vuln-ID|V-257164

APPL-13-000054 - The macOS system must implement approved ciphers to protect the confidentiality of SSH connections.

CCI|CCI-000803

CCI|CCI-000877

Rule-ID|SV-257165r905128_rule

STIG-ID|APPL-13-000054

Vuln-ID|V-257165

APPL-13-000055 - The macOS system must implement approved Message Authentication Codes (MACs) - MACs employing FIPS 140-2 validated cryptographic hash algorithms.

Rule-ID|SV-257166r905131_rule

STIG-ID|APPL-13-000055

Vuln-ID|V-257166

APPL-13-000056 - The macOS system must implement approved Key Exchange Algorithms.

Rule-ID|SV-257167r905134_rule

STIG-ID|APPL-13-000056

Vuln-ID|V-257167

APPL-13-001001 - The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all nonlocal maintenance and diagnostic sessions.

CCI|CCI-000018

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001405

CCI|CCI-002234

CCI|CCI-002884

Rule-ID|SV-257168r905137_rule

STIG-ID|APPL-13-001001

Vuln-ID|V-257168

APPL-13-001002 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.

CCI|CCI-000067

Rule-ID|SV-257169r905140_rule

STIG-ID|APPL-13-001002

Vuln-ID|V-257169

APPL-13-001003 - The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000159

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001889

CCI|CCI-001890

CCI|CCI-001914

CCI|CCI-002130

Rule-ID|SV-257170r905143_rule

STIG-ID|APPL-13-001003

Vuln-ID|V-257170

APPL-13-001010 - The macOS system must shut down by default upon audit failure (unless availability is an overriding concern).

CCI|CCI-000140

Rule-ID|SV-257171r905146_rule

STIG-ID|APPL-13-001010

Vuln-ID|V-257171

APPL-13-001012 - The macOS system must be configured with audit log files owned by root.

Rule-ID|SV-257172r905149_rule

STIG-ID|APPL-13-001012

Vuln-ID|V-257172

APPL-13-001013 - The macOS system must be configured with audit log folders owned by root.

Rule-ID|SV-257173r905152_rule

STIG-ID|APPL-13-001013

Vuln-ID|V-257173

APPL-13-001014 - The macOS system must be configured with audit log files group-owned by wheel.

Rule-ID|SV-257174r905155_rule

STIG-ID|APPL-13-001014

Vuln-ID|V-257174

APPL-13-001015 - The macOS system must be configured with audit log folders group-owned by wheel.

Rule-ID|SV-257175r905158_rule

STIG-ID|APPL-13-001015

Vuln-ID|V-257175

APPL-13-001016 - The macOS system must be configured with audit log files set to mode 440 or less permissive.

Rule-ID|SV-257176r905161_rule

Detections

Analytics

DISA STIG Apple macOS 13 v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous