id: pwpolicy_account_lockout_timeout_enforce
title: Set Account Lockout Time to $ODV Minutes
discussion: |
  The macOS _MUST_ be configured to enforce a lockout time period of at least $ODV minutes when the maximum number of failed logon attempts is reached.

  This rule protects against malicious users attempting to gain access to the system via brute-force hacking methods.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95338-0
      macos_15:
        - CCE-94332-4
      macos_14:
        - CCE-92928-1
    800-53r5:
      - AC-7
    800-171r3:
      - 03.01.08
  disa:
    cci:
      - CCI-002238
      - CCI-000044
    srg:
      - SRG-OS-000329-GPOS-00128
      - SRG-OS-000021-GPOS-00005
    disa_stig:
      macos_26:
        - APPL-26-000060
      macos_15:
        - APPL-15-000060
      macos_14:
        - APPL-14-000060
    cmmc:
      - AC.L2-3.1.8
  cis:
    benchmark:
      macos_26:
        - 5.2.1 (level 1)
      macos_15:
        - 5.2.1 (level 1)
      macos_14:
        - 5.2.1 (level 1)
    controls_v8:
      - 6.2
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= $ODV ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq
        result:
          string: pass
    introduced: '10.10'
odv:
  hint:
    datatype: number
    description: Number of minutes, e.g. 15
    validation:
      min: 1
  recommended: 15
  cis_lvl1: 15
  cis_lvl2: 15
  disa_stig: 15
tags:
  - 800-171
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
mobileconfig_info:
  - PayloadType: com.apple.mobiledevice.passwordpolicy
    PayloadContent:
      - minutesUntilFailedLoginReset: $ODV
ddm_info:
  declarationtype: com.apple.configuration.passcode.settings
  ddm_key: MaximumGracePeriodInMinutes
  ddm_value: $ODV
