1.5 Enable macOS update installs

Information

Ensure that macOS updates are installed after they are available from Apple. This setting enables macOS updates to be automatically installed. Some environments will want to approve and test updates before they are delivered. It is best practice to test first where updates can and have caused disruptions to operations. Automatic updates should be turned off where changes are tightly controlled and there are mature testing and approval processes. Automatic updates should not be turned off so the admin can call the users first to let them know it's ok to install. A dependable repeatable process involving a patch agent or remote management tool should be in place before auto-updates are turned off.

Rationale:

Patches need to be applied in a timely manner to reduce the risk of vulnerabilities being exploited

Impact:

Unpatched software may be exploited

Solution

Perform the following to enable macOS updates to run automatically:
Graphical Method:

Open System Preferences

Select App Store

Select Install macOS updates

Terminal Method:
Run the following command to to enable automatic checking and installing of macOS updates:

$ sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired -bool TRUE

See Also

https://workbench.cisecurity.org/files/3013

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-2(5)

Plugin: Unix

Control ID: 3bb2820306f55c564364d851b6efb6fac4e0b23f13ae784bcc1af10bbb7641ef