id: os_reauth_privilege
title: Require users to reauthenticate for privilege escalation
discussion: |-
  Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.

  NOTE: The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95275-4
      macos_15:
        - CCE-94272-2
      macos_14:
        - CCE-92868-9
    800-53r5:
      - IA-11
    800-171r3:
      - 03.05.01
  disa:
    srg:
      - SRG-OS-000373-GPOS-00157
      - SRG-OS-000373-GPOS-00156
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    '15.0': {}
    enforcement_info:
      fix:
        additional_info: The technology inherently meets this requirement. No fix is required.
tags:
  - 800-171
  - inherent
  - cnssi-1253_low
  - cnssi-1253_high
  - cnssi-1253_moderate
