id: system_settings_wifi_disable
title: Disable Wi-Fi Interface
discussion: |
  The macOS system must be configured with Wi-Fi support software disabled if not connected to an authorized trusted network.

  Allowing devices and users to connect to or from the system without first authenticating them allows untrusted access and can lead to a compromise or attack. Since wireless communications can be intercepted it is necessary to use encryption to protect the confidentiality of information in transit. Wireless technologies include for example  microwave packet radio (UHF/VHF) 802.11x and Bluetooth. Wireless networks use authentication protocols (e.g. EAP/TLS PEAP) which provide credential protection and mutual authentication.

  NOTE: If the system requires Wi-Fi to connect to an authorized network, this is not applicable.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95419-8
      macos_15:
        - CCE-94412-4
      macos_14:
        - CCE-93008-1
    800-53r5:
      - AC-4
      - AC-18
      - AC-18(1)
      - AC-18(3)
    800-171r3:
      - 03.01.03
      - 03.01.16
  disa:
    cmmc:
      - AC.L2-3.1.3
      - AC.L2-3.1.16
      - AC.L2-3.1.17
  hhs:
    hicp:
      - 2.L.A
      - 6.L.A
  cis:
    controls_v8:
      - 4.2
      - 12.6
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    '15.0': {}
    enforcement_info:
      check:
        shell: /usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi"
        result:
          integer: 1
      fix:
        shell: /usr/sbin/networksetup -setnetworkserviceenabled "Wi-Fi" off
tags:
  - manual
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - hicp_lp
