---
id: auth_smartcard_allow
title: Allow Smartcard Authentication
discussion: |
  Smartcard authentication _MUST_ be allowed.

  The use of smartcard credentials facilitates standardization and reduces the risk of unauthorized access.

  When enabled, the smartcard can be used for login, authorization, and screen saver unlocking.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95135-0
      macos_15:
        - CCE-94135-1
      macos_14:
        - CCE-92735-0
    800-53r5:
      - IA-2(1)
      - IA-2(2)
      - IA-2(12)
    800-171r3:
      - 03.05.03
  disa:
    cci:
      - CCI-000187
      - CCI-000765
      - CCI-000766
      - CCI-000767
      - CCI-000768
      - CCI-001941
      - CCI-001953
    srg:
      - SRG-OS-000107-GPOS-00054
      - SRG-OS-000112-GPOS-00057
      - SRG-OS-000108-GPOS-00055
      - SRG-OS-000106-GPOS-00053
      - SRG-OS-000376-GPOS-00161
      - SRG-OS-000105-GPOS-00052
      - SRG-OS-000068-GPOS-00036
    disa_stig:
      macos_26:
        - APPL-26-003030
      macos_15:
        - APPL-15-003030
      macos_14:
        - APPL-14-003030
    cmmc:
      - IA.L1-3.5.1
      - IA.L1-3.5.2
      - IA.L2-3.5.3
  hhs:
    hicp:
      - 3.L.A
      - ''
  cis:
    controls_v8:
      - 6.3
      - 6.4
      - 6.5
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
          .objectForKey('allowSmartCard').js
          EOS
        result:
          string: 'true'
    introduced: 10.12.4
tags:
  - 800-171
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
mobileconfig_info:
  - PayloadType: com.apple.security.smartcard
    PayloadContent:
      - allowSmartCard: true
