id: os_software_update_deferral
title: Ensure Software Update Deferment Is Less Than or Equal to $ODV Days
discussion: |
  Software updates _MUST_ be deferred for $ODV days or less.

  If you need to defer software updates, create a Restrictions profile using the com.apple.applicationaccess domain and the key enforcedSoftwareUpdateDelay.
references:
  nist:
    cce:
      macos_26:
        - CCE-95303-4
      macos_15:
        - CCE-94298-7
      macos_14:
        - CCE-92893-7
  cis:
    benchmark:
      macos_26:
        - 1.6 (level 1)
      macos_15:
        - 1.7 (level 1)
      macos_14:
        - 1.7 (level 1)
    controls_v8:
      - 7.3
      - 7.4
platforms:
  macOS:
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
      mobileconfig_info:
        - PayloadType: com.apple.applicationaccess
          PayloadContent:
            - enforcedSoftwareUpdateDelay: $ODV
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          function run() {
            let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
          .objectForKey('enforcedSoftwareUpdateDelay')) || 0
            if ( timeout <= $ODV ) {
              return("true")
            } else {
              return("false")
            }
          }
          EOS
        result:
          string: 'true'
odv:
  hint:
    datatype: number
    description: Number of days, e.g. 30
    validation:
      min: 1
  recommended: 30
  cis_lvl1: 30
  cis_lvl2: 30
