---
id: os_application_sandboxing
title: Ensure Separate Execution Domain for Processes
discussion: |-
  The inherent configuration of the macOS _IS_ in compliance as Apple has implemented multiple features Mandatory access controls (MAC), System Integrity Protection (SIP), and application sandboxing.

  link:https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web[]

  link:https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html[]

  NOTE: The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95160-8
      macos_15:
        - CCE-94160-9
      macos_14:
        - CCE-92760-8
    800-53r5:
      - SC-39
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    '15.0': {}
    enforcement_info:
      fix:
        additional_info: The technology inherently meets this requirement. No fix is required.
tags:
  - inherent
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cnssi-1253_low
  - cnssi-1253_high
  - cnssi-1253_moderate
