id: os_rapid_security_response_allow
title: Enforce Rapid Security Response Mechanism
discussion: |
  Rapid security response mechanism _MUST_ be enabled.
references:
  nist:
    cce:
      macos_15:
        - CCE-94269-8
      macos_14:
        - CCE-92865-5
    800-53r5:
      - SI-2
      - SI-2(5)
      - SI-3
    800-171r3:
      - 03.14.01
      - 03.14.02
  disa:
    cmmc:
      - SI.L1-3.14.1
      - SI.L1-3.14.2
      - SI.L1-3.14.4
platforms:
  macOS:
    '15.0': {}
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
          .objectForKey('allowRapidSecurityResponseInstallation').js
          EOS
        result:
          string: 'true'
    introduced: '13.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess
    PayloadContent:
      - allowRapidSecurityResponseInstallation: true
