id: system_settings_siri_disable
title: Disable Siri
discussion: |
  Support for Siri is non-essential and _MUST_ be disabled to prevent organizational data from being synchronized to Apple servers.

  Apple's Siri service does not provide an organization with enough control over the storage and access of data, and, therefore, automated synchronization _MUST_ be controlled by an organization approved service.

  The information system _MUST_ be configured to provide only essential capabilities.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95398-4
      macos_15:
        - CCE-94391-0
      macos_14:
        - CCE-92987-7
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-95689-6
      ios_18:
        - CCE-94551-9
      ios_17:
        - CCE-93499-2
      visionos_27:
        - CCE-XXXXX-X
      visionos_26:
        - CCE-95598-9
    800-53r5:
      - AC-20
      - CM-7
      - CM-7(1)
      - SC-7(10)
    800-171r3:
      - 03.01.20
      - 03.04.06
      - 03.04.08
  disa:
    cci:
      - CCI-000381
      - CCI-001774
    srg:
      - SRG-OS-000095-GPOS-00049
    disa_stig:
      macos_26:
        - APPL-26-002020
      macos_15:
        - APPL-15-002020
      macos_14:
        - APPL-14-002020
      ios_26:
        - AIOS-26-016100
      ios_18:
        - AIOS-18-016100
        - AIOS-18-016300
    cmmc:
      - AC.L1-B.1.III
      - AC.L1-3.1.20
      - CM.L2-3.4.6
      - CM.L2-3.4.7
    sfr:
      - 'FMT_MOF_EXT.1.2 #47'
  bsi:
    indigo:
      ios_26:
        - ANNEX K
      ios_18:
        - ANNEX K
      ios_17:
        - ANNEX K
  hhs:
    hicp:
      - 2.L.A
  cis:
    benchmark:
      macos_26:
        - 2.5.2.1 (level 1)
      macos_15:
        - 2.5.2.1 (level 1)
      macos_14:
        - 2.5.1 (level 1)
    controls_v8:
      - 4.1
      - 4.8
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: |-
            /usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
            .objectForKey('allowAssistant').js
            EOS
          result:
            string: 'false'
      mobileconfig_info:
        - PayloadType: com.apple.applicationaccess
          PayloadContent:
            - allowAssistant: false
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: |-
            /usr/bin/osascript -l JavaScript << EOS
            $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
            .objectForKey('allowAssistant').js
            EOS
          result:
            string: 'false'
      mobileconfig_info:
        - PayloadType: com.apple.applicationaccess
          PayloadContent:
            - allowAssistant: false            
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.ironwood.support')\
          .objectForKey('Assistant Allowed').js
          EOS
        result:
          string: 'false'            
    introduced: '14.0'
  iOS:
    '27.0': {}
    '26.0':
      supervised: false
      benchmarks:
        - name: ios_stig
          severity: high
        - name: indigo_base
          severity: high
        - name: indigo_high
          severity: high
    '18.0':
      supervised: false
      benchmarks:
        - name: ios_stig
          severity: high
        - name: indigo_base
          severity: high
        - name: indigo_high
          severity: high
    '17.0':
      supervised: false
      benchmarks:
        - name: indigo_base
          severity: high
        - name: indigo_high
          severity: high
    introduced: '5.0'
  visionOS:
    '27.0': {}
    '26.0':
      supervised: false
    introduced: '2.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl3
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
mobileconfig_info:
  - PayloadType: com.apple.applicationaccess
    PayloadContent:
      - allowAssistant: false   
ddm_info:
  declarationtype: com.apple.configuration.siri.settings
  ddm_key: Enabled
  ddm_value: false
