---
id: auth_smartcard_enforce
title: Enforce Smartcard Authentication
discussion: |
  Smartcard authentication _MUST_ be enforced.

  The use of smartcard credentials facilitates standardization and reduces the risk of unauthorized access.

  When enforceSmartCard is set to "true", the smartcard must be used for login, authorization, and unlocking the screensaver.

  CAUTION: enforceSmartCard will apply to the whole system. No users will be able to login with their password unless the profile is removed or a user is exempt from smartcard enforcement.

  NOTE: enforceSmartcard requires allowSmartcard to be set to true in order to work.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95138-4
      macos_15:
        - CCE-94138-5
      macos_14:
        - CCE-92738-4
    800-53r5:
      - IA-2(1)
      - IA-2(2)
      - IA-2(6)
      - IA-2
      - IA-5(2)
      - IA-2(12)
      - IA-2(8)
    800-171r3:
      - 03.05.01
      - 03.05.03
      - 03.05.04
  disa:
    cci:
      - CCI-000186
      - CCI-000765
      - CCI-000766
      - CCI-000767
      - CCI-000768
      - CCI-001941
      - CCI-001948
      - CCI-001953
      - CCI-004046
    srg:
      - SRG-OS-000107-GPOS-00054
      - SRG-OS-000112-GPOS-00057
      - SRG-OS-000067-GPOS-00035
      - SRG-OS-000108-GPOS-00055
      - SRG-OS-000106-GPOS-00053
      - SRG-OS-000375-GPOS-00160
      - SRG-OS-000376-GPOS-00161
      - SRG-OS-000105-GPOS-00052
      - SRG-OS-000705-GPOS-00150
    disa_stig:
      macos_26:
        - APPL-26-003020
      macos_15:
        - APPL-15-003020
      macos_14:
        - APPL-14-003020
    cmmc:
      - IA.L1-3.5.1
      - IA.L1-3.5.2
      - IA.L2-3.5.3
      - IA.L2-3.5.4
  hhs:
    hicp:
      - 3.L.A
      - ''
  cis:
    controls_v8:
      - 6.3
      - 6.4
      - 6.5
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
          .objectForKey('enforceSmartCard').js
          EOS
        result:
          string: 'true'
    introduced: 10.13.2
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
mobileconfig_info:
  - PayloadType: com.apple.security.smartcard
    PayloadContent:
      - enforceSmartCard: true
      - allowSmartCard: true
