id: os_parental_controls_enable
title: Enable Parental Controls
discussion: |
  Parental Controls _MUST_ be enabled.

  Control of program execution is a mechanism used to prevent program execution of unauthorized programs, which is critical to maintaining a secure system baseline.

  Parental Controls on the macOS consist of many different payloads, which are set individually depending on the type of control required. Enabling parental controls allows for further configuration of these restrictions.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
  .objectForKey('familyControlsEnabled').js
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-94246-6
  cci:
    - N/A
  800-53r5:
    - CM-7(2)
  800-53r4:
    - CM-7(2)
  srg:
    - N/A
  disa_stig:
    - N/A
  800-171r3:
    - 03.04.06
  cis:
    benchmark:
      - N/A
    controls v8:
      - 4.8
macOS:
  - '15.0'
tags:
  - cnssi-1253_low
  - cnssi-1253_high
  - cnssi-1253_moderate
mobileconfig: true
mobileconfig_info:
  com.apple.applicationaccess.new:
    familyControlsEnabled: true
