id: system_settings_biometric_disable
title: Disable TouchID/OpticID for Unlocking the Device
discussion: |
  TouchID and OpticID enables the ability to unlock an Apple device with a user's fingerprint or iris.

  TouchID _MUST_ be disabled for "Unlocking your Mac" on all macOS devices that are capable of using Touch ID. OpticID _MUST_ be disabled for "Unlocking your device" on all devices that are capable of using OpticID.

  The system _MUST_ remain locked until the user establishes access using an authorized identification and authentication method.

  NOTE: TouchID and OpticID is not an approved biometric authenticator for US Federal Government usage as it has not been verified to meet the strength requirements outlined in NIST SP 800-63.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95415-6
      macos_15:
        - CCE-94408-2
      macos_14:
        - CCE-93003-2
      visionos_27:
        - CCE-XXXXX-X
      visionos_26:
        - CCE-95597-1
    800-53r5:
      - IA-5
    800-171r3:
      - 03.05.12
  disa:
    cci:
      - CCI-000056
    srg:
      - SRG-OS-000028-GPOS-00009
    disa_stig:
      macos_26:
        - APPL-26-002090
      macos_15:
        - APPL-15-002090
      macos_14:
        - APPL-14-002090
    cmmc:
      - AC.L2-3.1.10
  hhs:
    hicp:
      - 3.L.A
      - 3.L.B
      - 2.L.B
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
          .objectForKey('allowFingerprintForUnlock').js
          EOS
        result:
          string: 'false'
    introduced: 10.12.4
  visionOS:
    '27.0': {}
    '26.0':
      supervised: true
    introduced: '2.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - hicp_lp
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess
    PayloadContent:
      - allowFingerprintForUnlock: false
