id: os_reauth_devices_change_authenticators
title: Require Devices to Reauthenticate when Changing Authenticators
discussion: |
  The macOS should be configured to require users to reauthenticate when the device authenticator is changed.

  Without reauthentication, users may access resources or perform tasks for which they are not authorization. When operating systems provide the capability to change device authenticators, it is critical the device reauthenticate.
check: |
  The technology does not support this requirement. This is an applicable-does not meet finding.
fix: |
  This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented, but this finding cannot be considered fixed.
references:
  cce:
    - CCE-95274-7
  cci:
    - N/A
  800-53r5:
    - IA-11
  800-53r4:
    - IA-11
  disa_stig:
    - N/A
  srg:
    - SRG-OS-000374-GPOS-00159
  800-171r3:
    - 03.05.01
macOS:
  - '26.0'
tags:
  - 800-171
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - permanent
  - cnssi-1253_low
  - cnssi-1253_high
  - srg
  - cnssi-1253_moderate
mobileconfig: false
mobileconfig_info:
