id: system_settings_filevault_enforce
title: Enforce FileVault
discussion: | 
  FileVault _MUST_ be enabled. 
  
  On Mac computers with Apple silicon or the Apple T2 Security Chip, internal storage is encrypted by default. Enabling FileVault provides additional protection by requiring an authorized user's credentials or a valid recovery key to unlock the data volume during the boot process. 
  
  When FileVault is enabled, the volume encryption key is protected by both the hardware UID and the user's credentials. This protects data at rest against unauthorized access if the device is lost, stolen, or otherwise removed from a controlled area. 
  
  NOTE: See the FileVault supplemental guidance for implementation and recovery-key escrow requirements.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95367-9
      macos_15:
        - CCE-94360-5
      macos_14:
        - CCE-92957-0
    800-53r5:
      - SC-28
      - SC-28(1)
    800-171r3:
      - 03.13.08
  disa:
    cci:
      - CCI-001199
      - CCI-002475
      - CCI-002476
    srg:
      - SRG-OS-000185-GPOS-00079
      - SRG-OS-000405-GPOS-00184
      - SRG-OS-000404-GPOS-00183
    disa_stig:
      macos_26:
        - APPL-26-005020
      macos_15:
        - APPL-15-005020
      macos_14:
        - APPL-14-005020
    cmmc:
      - SC.L2-3.13.16
  bzk:
    bio:
      - 8.01
      - 8.01.01
  hhs:
    hicp:
      - 2.L.A
      - 2.L.B
      - 4.L.A
      - 4.L.B
      - 5.L.A
  cis:
    benchmark:
      macos_26:
        - 2.6.6 (level 1)
      macos_15:
        - 2.6.6 (level 1)
      macos_14:
        - 2.6.6 (level 1)
    controls_v8:
      - 3.6
      - 3.11
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: high
        - name: nlmapgov_plus
        - name: nlmapgov_base
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: high
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: |-
          dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\
          .objectForKey('dontAllowFDEDisable').js
          EOS
          )
          fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.")
          if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then
            echo "1"
          else
            echo "0"
          fi
        result:
          integer: 1
      fix:
        additional_info: 'NOTE: See the FileVault supplemental to implement this rule.'
    introduced: '-1'
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - hicp_lp
mobileconfig_info:
  - PayloadType: com.apple.MCX
    PayloadContent:
      - dontAllowFDEDisable: true
