id: system_settings_software_update_enforce
title: Enforce Software Update Automatically
discussion: |
  Software Update _MUST_ be configured to enforce automatic update is enabled.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-XXXXX-X
      macos_15:
        - CCE-94397-7
      macos_14:
        - CCE-92992-7
    800-53r5:
      - SI-2(5)
    800-171r3:
      - 03.14.01
      - 03.14.02
      - 03.13.03
  bzk:
    bio:
      - 8.08.01
  cis:
    benchmark:
      macos_15:
        - 1.2 (level 1)
      macos_14:
        - 1.2 (level 1)
    controls_v8:
      - 7.3
      - 7.4
platforms:
  macOS:
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\
          .objectForKey('AutomaticCheckEnabled').js
          EOS
        result:
          string: 'true'
    introduced: '10.15'
tags:
  - cisv8
mobileconfig_info:
  - PayloadType: com.apple.SoftwareUpdate
    PayloadContent:
      - AutomaticCheckEnabled: true
