id: os_malicious_code_prevention
title: Ensure the System Implements Malicious Code Protection Mechanisms
discussion: |
  The inherent configuration of the macOS _IS_ in compliance as Apple has designed the system with three layers of protection against malware. Each layer of protection is comprised of one or more malicious code protection mechanisms, which are automatically implemented and which, collectively, meet the requirements of all applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for malicious code prevention.

  1. This  first layer of defense targets the distribution of malware; the aim is to prevent malware from ever launching.
  The following mechanisms are inherent to the macOS design and constitute the first layer of protection against malicious code:
  *	The Apple App Store: the safest way to add new applications to a Mac is by downloading them from the App Store; all apps available for download from the App Store have been reviewed for signs of tampering and signed by Apple to indicate that the app meets security requirements and does not contain malware.
  *	XProtect: a built-in, signature-based, anti-virus, anti-malware technology inherent to all Macs. XProtect automatically detects and blocks the execution of known malware.
    *	In macOS 10.15 and all subsequent releases, XProtect checks for known malicious content when:
      *	an app is first launched,
      *	an app has been changed (in the file system), and
      *	XProtect signatures are updated.
  *	YARA: another built-in tool (inherent to all Macs), which conducts signature-based detection of malware. Apple updates YARA rules regularly.
  *	Gatekeeper: a security feature inherent to all Macs; Gatekeeper scans apps to detect malware and/or revocations of a developer's signing certificate and prevents unsafe apps from running.
  *	Notarization: Apple performs regular, automated scans to detect signs of malicious content and to verify developer ID-signed software; when no issues are found, Apple notarizes the software and delivers the results of scans to the system owner.

  2. The second layer of defense targets malware that manages to appear on a Mac before it runs; the aim is to quickly identify and block any malware present on a Mac in order to prevent the malware from running and further spreading.
  The following mechanisms are inherent to the macOS design and constitute the second layer of protection against malicious code:
  *	XProtect (defined above).
  *	Gatekeeper (defined above).
  *	Notarization (defined above).

  3.  The third layer of defense targets infected Mac system(s); the aim is to remediate Macs on which malware has managed to successfully execute.
  The following mechanism is inherent to the macOS design and constitutes the third layer of protection against malicious code:
  *	Apple's XProtect: a technology included on all macOS systems. XProtect will remediate infections upon receiving updated information delivered and when infections are detected

  link:https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/1/web/1[]

  link:https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/web[]
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95224-2
      macos_15:
        - CCE-94224-3
      macos_14:
        - CCE-92821-8
    800-53r5:
      - SI-3
    800-171r3:
      - 03.14.02
  disa:
    cmmc:
      - SI.L1-3.14.1
      - SI.L1-3.14.2
      - SI.L1-3.14.4
  hhs:
    hicp:
      - 2.L.A
      - 7.L.B
      - 8.L.A
  cis:
    controls_v8:
      - 10.1
      - 10.2
      - 10.5
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    '15.0': {}
    enforcement_info:
      fix:
        additional_info: The technology inherently meets this requirement. No fix is required.
tags:
  - 800-171
  - inherent
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
