2.3.3 Ensure Gatekeeper Is Enabled

Information

Gatekeeper is Apple's application that utilizes allowlisting to restrict downloaded applications from launching. It functions as a control to limit applications from unverified sources from running without authorization. In an update to Gatekeeper in macOS 13 Ventura, Gatekeeper checks every application on every launch, not just quarantined apps.

Disallowing unsigned software will reduce the risk of unauthorized or malicious applications from running on the system.

Solution

Run the following command to enable Gatekeeper to allow applications from App Store and identified developers:

% /usr/bin/sudo /usr/sbin/spctl --master-enable

See Also

https://workbench.cisecurity.org/benchmarks/17466

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, 800-53|SI-16, CSCv7|8.2, CSCv7|8.4

Plugin: Unix

Control ID: 5f0a1dc533444b2f5cae69f2ddfb4fc03bbb4fada5eb2133f45b55439b0ba763