id: os_sleep_and_display_sleep_apple_silicon_enable
title: Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices
discussion: |
  Apple Silicon MacBooks should set sleep timeout to 15 minutes (900 seconds) or less and the display sleep timeout should be 10 minutes (600 seconds) or less but less than the sleep setting.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95302-6
      macos_15:
        - CCE-94200-3
      macos_14:
        - CCE-92800-2
  cis:
    benchmark:
      macos_26:
        - 2.10.1.2 (level 2)
      macos_15:
        - 2.10.1.1 (level 2)
      macos_14:
        - 2.9.1.2 (level 2)
    controls_v8:
      - 4.1
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl2
    '15.0':
      benchmarks:
        - name: cis_lvl2
      enforcement_info:
        check:
          shell: |-
            error_count=0
            if /usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep -q "MacBook"; then
              cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string)
              if echo "$cpuType" | grep -q "Apple"; then
                sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}')
                displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}')
                if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then
                  ((error_count++))
                fi
                if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then
                  ((error_count++))
                fi
              fi
            fi
            echo "$error_count"
          result:
            integer: 0
    enforcement_info:
      check:
        shell: |-
          error_count=0
          if /usr/sbin/system_profiler SPHardwareDataType 2>/dev/null  | /usr/bin/grep -Ei "MacBook|Mac[0-9]" > /dev/null ; then
            cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string)
            if echo "$cpuType" | grep -q "Apple"; then
              sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}')
              displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}')
              if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then
                ((error_count++))
              fi
              if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then
                ((error_count++))
              fi
            fi
          fi
          echo "$error_count"
        result:
          integer: 0
      fix:
        shell: |-
          /usr/bin/pmset -a sleep 15
          /usr/bin/pmset -a displaysleep 10
tags:
  - cisv8
  - arm64
