id: system_settings_critical_update_install_enforce
title: Enforce Critical Security Updates to be Installed
discussion: |
  Ensure that security updates are installed as soon as they are available from Apple.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95363-8
      macos_15:
        - CCE-94358-9
      macos_14:
        - CCE-92955-4
    800-53r5:
      - SI-2
    800-171r3:
      - 03.14.01
  disa:
    cmmc:
      - SI.L1-3.14.1
      - SI.L1-3.14.4
  hhs:
    hicp:
      - 2.L.A
      - 2.L.B
      - 5.L.A
      - 7.L.B
  cis:
    benchmark:
      macos_26:
        - 1.5 (level 1)
      macos_15:
        - 1.6 (level 1)
      macos_14:
        - 1.6 (level 1)
    controls_v8:
      - 7.3
      - 7.4
      - 7.7
  bzk:
    bio:
      - 8.08.01
  hhs:
    hicp:
      - 2.L.A
      - 2.L.B
      - 3.L.C
      - 5.L.A
      - 7.L.B      
platforms:
  macOS:
    '27.0': {}
    '26.0':
      enforcement_info:
        check:
          shell: 
            configprofile=$(/usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\
            .objectForKey('CriticalUpdateInstall').js
            EOS
            )

            ddm=$(/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates')

            if [[ "$configprofile" == "true" ]] || [[ "$ddm" == "1" ]]; then
              echo "true"
            else
              echo "false"
            fi          
          result:
            string: 'true'
        fix:
          additional_info: This is implemented by Declarative Device Management (DDM) or by a configuration profile.
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: nlmapgov_plus
        - name: nlmapgov_base
      mobileconfig_info:
        - PayloadType: com.apple.SoftwareUpdate
          PayloadContent:
          - CriticalUpdateInstall: true
    '15.0':
      enforcement_info:
        check:
          shell: |-
            /usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\
            .objectForKey('CriticalUpdateInstall').js
            EOS
          result:
            string: 'true'
      mobileconfig_info:
        - PayloadType: com.apple.SoftwareUpdate
          PayloadContent:
          - CriticalUpdateInstall: true            
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: 
          /usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates'
        result:
          integer: 1
      fix:
        additional_info: This is implemented by Declarative Device Management (DDM)      
    introduced: '10.15'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
ddm_info:
  declarationtype: com.apple.configuration.softwareupdate.settings
  ddm_key: AutomaticActions
  ddm_value:
    InstallSecurityUpdate: AlwaysOn
