id: os_firmware_password_require
title: Enable Firmware Password
discussion: |
  A firmware password _MUST_ be enabled and set.

  Single user mode, recovery mode, the Startup Manager, and several other tools are available on macOS by holding the "Option" key down during startup. Setting a firmware password restricts access to these tools.

  To set a firmware passcode use the following command:

  [source,bash]
  ----
  /usr/sbin/firmwarepasswd -setpasswd
  ----

  NOTE: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through the use of a machine specific binary generated and provided by Apple. Schedule a support call, and provide proof of purchase before the firmware binary will be generated.

  NOTE: Firmware passwords are not supported on Apple Silicon devices. This rule is only applicable to Intel devices.
check: |
  /usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes"
result:
  integer: 1
fix: |
  NOTE: See discussion on how to enable firmware password.
references:
  cce:
    - CCE-95194-7
  cci:
    - CCI-000366
  800-53r5:
    - AC-6
  800-53r4:
    - AC-6
  srg:
    - SRG-OS-000480-GPOS-00227
  disa_stig:
    - N/A
  800-171r3:
    - 03.01.05
  cmmc:
    - AC.L1-3.1.1
    - AC.L2-3.1.5
macOS:
  - '26.0'
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - i386
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
severity: medium
mobileconfig: false
mobileconfig_info:
