2.5.7 Ensure Gatekeeper Is Enabled

Information

Gatekeeper is Apple's application that utilizes allowlisting to restrict downloaded applications from launching. It functions as a control to limit applications from unverified sources from running without authorization.

Rationale:

Disallowing unsigned software will reduce the risk of unauthorized or malicious applications from running on the system.

Solution

Graphical Method:
Perform the following steps to enable Gatekeeper:

Open System Preferences

Select Security & Privacy

Select General

Set 'Allow apps downloaded from:' to 'App Store and identified developers'

Terminal Method:
Run the following command to enable Gatekeeper to allow applications from App Store and identified developers:

$ /usr/bin/sudo /usr/sbin/spctl --master-enable

Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.systempolicy.control

The key to include is AllowIdentifiedDevelopers

The key must be set to <true/>

The key to also include is EnableAssessment

The key must be set to <true/>

See Also

https://workbench.cisecurity.org/files/4176

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, 800-53|SI-16, CSCv7|8.2, CSCv7|8.4

Plugin: Unix

Control ID: bbe8e2b7a927e86fc4c39add0ed9d2f7602baa8927aed1fbac62b679689e1bc3