id: system_settings_install_macos_updates_enforce
title: Enforce macOS Updates are Automatically Installed
discussion: |
  Software Update _MUST_ be configured to enforce automatic installation of macOS updates is enabled.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-XXXXX-X
      macos_15:
        - CCE-94373-8
      macos_14:
        - CCE-92968-7
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-96731-5        
  cis:
    benchmark:
      macos_26:
        - 1.3 (level 1)
      macos_15:
        - 1.4 (level 1)
      macos_14:
        - 1.4 (level 1)
    controls_v8:
      - 7.3
      - 7.4
  bzk:
    bio:
      - 8.08
      - 8.08.01
platforms:
  macOS:
    '27.0': {}
    '26.0':
      enforcement_info:
        check:
          shell: |-
            configprofile=$(/usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\
            .objectForKey('AutomaticallyInstallMacOSUpdates').js
            EOS
            )

            ddm=$(/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallOSUpdates')

            if [[ "$configprofile" == "true" ]] || [[ "$ddm" == "1" ]]; then
              echo "true"
            else
              echo "false"
            fi
          result:
            string: 'true'
          fix:
            additional_info: This is implemented by Declarative Device Management (DDM) or by a configuration profile.
      mobileconfig_info:
        - PayloadType: com.apple.SoftwareUpdate
          PayloadContent:
            - AutomaticallyInstallMacOSUpdates: true            
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: nlmapgov_plus
        - name: nlmapgov_base        
    '15.0':
      enforcement_info:
        check:
          shell: |-
            /usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\
            .objectForKey('AutomaticallyInstallMacOSUpdates').js
            EOS
          result:
            string: 'true'
      mobileconfig_info:
        - PayloadType: com.apple.SoftwareUpdate
          PayloadContent:
            - AutomaticallyInstallMacOSUpdates: true            
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: /usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallOSUpdates'
        result:
          integer: 1
      fix:
        additional_info: This is implemented by Declarative Device Management (DDM).        
    
    introduced: '10.15'
  iOS:
    '27.0': {}
    '26.0':
      supervised: true
      benchmarks:
        - name: nlmapgov_base
        - name: nlmapgov_plus
tags:
  - cisv8
ddm_info:
  declarationtype: com.apple.configuration.softwareupdate.settings
  ddm_key: AutomaticActions
  ddm_value:
    InstallOSUpdates: AlwaysOn
