id: system_settings_filevault_enforce
title: Enforce FileVault
discussion: |
  FileVault _MUST_ be enforced.

  The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

  NOTE: See the FileVault supplemental to implement this rule.
check: |
  dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\
  .objectForKey('dontAllowFDEDisable').js
  EOS
  )
  fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.")
  if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then
    echo "1"
  else
    echo "0"
  fi
result:
  integer: 1
fix: |
  NOTE: See the FileVault supplemental to implement this rule.
references:
  cce:
    - CCE-94360-5
  cci:
    - CCI-001199
    - CCI-002475
    - CCI-002476
  800-53r5:
    - SC-28
    - SC-28(1)
  800-53r4:
    - SC-28
    - SC-28(1)
  srg:
    - SRG-OS-000185-GPOS-00079
    - SRG-OS-000405-GPOS-00184
    - SRG-OS-000404-GPOS-00183
  disa_stig:
    - APPL-15-005020
  800-171r3:
    - 03.13.08
  cis:
    benchmark:
      - 2.6.6 (level 1)
    controls v8:
      - 3.6
      - 3.11
  cmmc:
    - SC.L2-3.13.16
  bio:
    - 8.01.01
macOS:
  - '15.0'
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
  - nlmapgov_base
  - nlmapgov_plus
severity: high
mobileconfig: true
mobileconfig_info:
  com.apple.MCX:
    dontAllowFDEDisable: true
