---
id: audit_auditd_enabled
title: Enable Security Auditing
discussion: |
  The information system _MUST_ be configured to generate audit records.

  Audit records establish what types of events have occurred, when they occurred, and which users were involved. These records aid an organization in their efforts to establish, correlate, and investigate the events leading up to an outage or attack.

  The content required to be captured in an audit record varies based on the impact level of an organization's system. Content that may be necessary to satisfy this requirement includes, for example, time stamps, source addresses, destination addresses, user identifiers, event descriptions, success/fail indications, filenames involved, and access or flow control rules invoked.

  The information system initiates session audits at system start-up.

  NOTE: Security auditing is NOT enabled by default on macOS 14 and later.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95104-6
      macos_15:
        - CCE-94104-7
      macos_14:
        - CCE-92704-6
    800-53r5:
      - AU-3
      - AU-3(1)
      - AU-8
      - AU-12
      - AU-12(1)
      - AU-12(3)
      - AU-14(1)
      - MA-4(1)
      - CM-5(1)
    800-171r3:
      - 03.03.02
      - 03.03.03
      - 03.03.07
  disa:
    cci:
      - CCI-000130
      - CCI-000131
      - CCI-000132
      - CCI-000133
      - CCI-000134
      - CCI-000135
      - CCI-000159
      - CCI-001464
      - CCI-001487
      - CCI-001889
      - CCI-001890
      - CCI-001914
      - CCI-002130
      - CCI-003938
      - CCI-004188
    srg:
      - SRG-OS-000255-GPOS-00096
      - SRG-OS-000474-GPOS-00219
      - SRG-OS-000465-GPOS-00209
      - SRG-OS-000473-GPOS-00218
      - SRG-OS-000337-GPOS-00129
      - SRG-OS-000359-GPOS-00146
      - SRG-OS-000472-GPOS-00217
      - SRG-OS-000257-GPOS-00098
      - SRG-OS-000466-GPOS-00210
      - SRG-OS-000042-GPOS-00020
      - SRG-OS-000468-GPOS-00212
      - SRG-OS-000392-GPOS-00172
      - SRG-OS-000463-GPOS-00207
      - SRG-OS-000039-GPOS-00017
      - SRG-OS-000467-GPOS-00211
      - SRG-OS-000470-GPOS-00214
      - SRG-OS-000461-GPOS-00205
      - SRG-OS-000258-GPOS-00099
      - SRG-OS-000471-GPOS-00215
      - SRG-OS-000458-GPOS-00203
      - SRG-OS-000037-GPOS-00015
      - SRG-OS-000040-GPOS-00018
      - SRG-OS-000471-GPOS-00216
      - SRG-OS-000476-GPOS-00221
      - SRG-OS-000254-GPOS-00095
      - SRG-OS-000042-GPOS-00021
      - SRG-OS-000358-GPOS-00145
      - SRG-OS-000477-GPOS-00222
      - SRG-OS-000365-GPOS-00152
      - SRG-OS-000475-GPOS-00220
      - SRG-OS-000041-GPOS-00019
      - SRG-OS-000038-GPOS-00016
      - SRG-OS-000462-GPOS-00206
      - SRG-OS-000055-GPOS-00026
      - SRG-OS-000755-GPOS-00220
    disa_stig:
      macos_26:
        - APPL-26-001003
      macos_15:
        - APPL-15-001003
      macos_14:
        - APPL-14-001003
    cmmc:
      - AU.L2-3.3.2
      - AU.L2-3.3.6
  bzk:
    bio:
      - 8.18
      - 8.18.02
  hhs:
    hicp:
      - 8.L.A
  cis:
    benchmark:
      macos_26:
        - 3.1 (level 1)
      macos_15:
        - 3.1 (level 1)
      macos_14:
        - 3.1 (level 1)
    controls_v8:
      - 8.2
      - 8.5
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
        - name: nlmapgov_base
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
        - name: nlmapgov_base
      enforcement_info:
        check:
          shell: |-
            LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd)
            AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING")
            if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then
              echo "pass"
            else
              echo "fail"
            fi
          result:
            string: pass
    enforcement_info:
      check:
        shell: |-
          LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd')
          AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING")
          if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then
            echo "pass"
          else
            echo "fail"
          fi
        result:
          string: pass
      fix:
        shell: |-
          if [[ ! -e /etc/security/audit_control ]] && [[ -e /etc/security/audit_control.example ]];then
            /bin/cp /etc/security/audit_control.example /etc/security/audit_control
          fi

          /bin/launchctl enable system/com.apple.auditd
          /bin/launchctl bootstrap system /System/Library/LaunchDaemons/com.apple.auditd.plist
          /usr/sbin/audit -i
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - hicp_lp
