id: os_setup_assistant_filevault_enforce
title: Enforce FileVault in Setup Assistant
discussion: |
  FileVault _MUST_ be enforced in Setup Assistant.

  The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\
  .objectForKey('ForceEnableInSetupAssistant')
  EOS
result:
  integer: 1
fix: |
  NOTE: See the FileVault supplemental to implement this rule.
references:
  cce:
    - CCE-95296-0
  cci:
    - N/A
  800-53r5:
    - SC-28
    - SC-28(1)
  800-53r4:
    - SC-28
    - SC-28(1)
  srg:
    - N/A
  disa_stig:
    - N/A
  800-171r3:
    - 03.13.08
  cis:
    benchmark:
      - N/A
    controls v8:
      - 3.6
      - 3.11
  cmmc:
    - SC.L2-3.13.16
  bio:
    - 8.01.01
macOS:
  - '26.0'
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cmmc_lvl2
  - cnssi-1253_moderate
  - cnssi-1253_low
  - cnssi-1253_high
  - nlmapgov_plus
severity: high
mobileconfig: true
mobileconfig_info:
  com.apple.MCX.FileVault2:
    ForceEnableInSetupAssistant: true
    Enable: On
