id: os_background_security_improvement_install_enable
title: Enforce Background Security Improvements are Automatically Installed using DDM.
discussion: |
  Background Security Improvements _MUST_ be configured to enforce automatic installation and that the user cannot modify the setting within Settings.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-96728-1
    800-53r5:
      - CM-11
      - SI-2
  bzk:
    bio:
      - 8.08
platforms:
  macos:
    '27.0': {}
    enforcement_info:
      check:
        shell: /usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.enableRapidSecurityResponse'
        result:
          string: 'false'
      fix:
        additional_info: This is implemented by Declarative Device Management (DDM).
  iOS:
    '27.0': {}
    '26.0':
      supervised: true
      benchmarks:
        - name: nlmapgov_base
        - name: nlmapgov_plus
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high       
ddm_info:
  declarationtype: com.apple.configuration.softwareupdate.settings
  ddm_key: RapidSecurityResponse
  ddm_value:
    Enable: true
