id: os_logical_access
title: Enforce Approved Authorization for Logical Access
discussion: |
  The information system _IS_ configured to enforce an approved authorization process before granting users logical access.

  The inherent configuration of the macOS does not grant users logical access without authorization. Authorization is achieved on the macOS through permissions, which are controlled at many levels, from the Mach and BSD components of the kernel, through higher levels of the operating system and, for networked applications, through the networking protocols. Permissions can be granted at the level of directories, subdirectories, files or applications, or specific data within files or functions within applications.

  link:https://developer.apple.com/library/archive/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Permissions/Permissions.html[]
check: |
  The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
fix: |
  The technology inherently meets this requirement. No fix is required.
references:
  cce:
    - CCE-95219-2
  cci:
    - N/A
  800-53r5:
    - AC-3
  800-53r4:
    - AC-3
  disa_stig:
    - N/A
  srg:
    - SRG-OS-000080-GPOS-00048
  800-171r3:
    - 03.01.02
  cis:
    benchmark:
      - N/A
    controls v8:
      - 3.3
      - 6.7
  cmmc:
    - AC.L1-3.1.1
macOS:
  - '26.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - inherent
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - srg
  - cnssi-1253_moderate
mobileconfig: false
mobileconfig_info:
