---
id: os_apple_intelligence_pcc_disable
title: Disable Apple Intelligence Private Cloud Compute
discussion: |
  Apple Intelligence Private Cloud Compute sends data to off-device infrastructure that is not directly controlled by the organization. Therefore, Apple Intelligence features that rely on off-device processing MUST be disabled unless explicitly approved by the organization.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X      
    800-53r5:
      - AC-20
      - AC-20(1)
      - CM-7
      - CM-7(1)
      - SC-7(10)
    800-171r3:
      - 03.01.20
      - 03.04.06
  disa:
    cci:
      - CCI-000381
      - CCI-001774
    srg:
      - SRG-OS-000095-GPOS-00049
    cmmc:
      - AC.L1-3.1.20
      - CM.L2-3.4.6
      - CM.L2-3.4.7
  hhs:
    hicp:
      - 2.L.A
      - 4.L.A
      - 4.L.B
  cis:
    controls_v8:
      - 4.1
      - 4.8
      - 15.3
platforms:
  macOS:
    '27.0': {}    
    enforcement_info:
      check:
        shell: |-
          apple_intelligence_servers=("127.0.0.1 apple-relay.cloudflare.com" "127.0.0.1 apple-relay.fastly-edge.com" "127.0.0.1 cp4.cloudflare.com" "127.0.0.1 apple-relay.apple.com")
          total=0
          for config in $apple_intelligence_servers; do
            total=$(expr $(/usr/bin/grep -i -c "^$config" /etc/hosts) + $total)
          done
          echo $total
        result:
          integer: 4
      fix:
        shell: |-    
          apple_intelligence_servers=("127.0.0.1 apple-relay.cloudflare.com" "127.0.0.1 apple-relay.fastly-edge.com" "127.0.0.1 cp4.cloudflare.com" "127.0.0.1 apple-relay.apple.com")
          host_file=$(/bin/cat /etc/hosts)
          for config in $apple_intelligence_servers; do
            if ! echo $host_file | /usr/bin/grep -q -i "^$config" 2>/dev/null; then
              /usr/bin/grep -qxF "^$config" "/etc/hosts" 2>/dev/null || echo "$config" >> "/etc/hosts"
            fi
          done
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
