fix(cis): correct manual supplementals for macOS 15 and 26

The per-version files were seeded from supplemental_cis_manual.yaml
before PR #781's corrections to it merged, so those corrections reached
supplemental_cis_manual_27 but not these two. Checked against Sequoia
v2.1.0 and Tahoe v1.1.0.

Both files:
- Remove 5.3.1 and 5.3.2. They are Automated, level 1, and implemented
  by os_internal_apfs_volumes_encrypted and os_external_apfs_hfs_
  volumes_encrypted on macOS 15, 26 and 27.
- Add 5.3.3 Audit Connected FAT32 and ExFAT Drives, which is Manual.
- Use the published titles for 2.1.1.1, 2.5.2.2 and 2.15.1.

macOS 15 only:
- Add 2.4.1 Audit Menu Bar and Control Center Icons, which is Manual.
- Use the published titles for 2.1.1.4 and 6.5.1, and list 6.5.1 under
  Applications as the macOS 26 and 27 files do.

macOS 26 only:
- Remove 1.7. Tahoe v1.1.0 ends at 1.6, and no MDM recommendation
  appears in the Sequoia, Tahoe or Golden Gate benchmarks.
This commit is contained in:
Tony Young
2026-09-24 06:12:37 -04:00
parent 3638386258
commit 0136fa8b3d
2 changed files with 11 additions and 21 deletions

View File

@@ -10,14 +10,15 @@ discussion: |
|System Settings
|Recommendations
|2.1.1.1 Audit iCloud Keychain +
|2.1.1.1 Audit iCloud Passwords & Keychain +
2.1.1.2 Audit iCloud Drive +
2.1.1.4 Audit Security Keys Used With AppleIDs +
2.1.1.4 Audit Security Keys Used With Apple Accounts +
2.1.1.5 Audit Freeform Sync to iCloud +
2.1.1.6 Audit Find My Mac +
2.1.2 Audit App Store Password Settings +
2.3.3.11 Ensure Computer Name Does Not Contain PII or Protected Organizational Information +
2.5.2.2 Ensure Listen for Siri is Disabled +
2.4.1 Audit Menu Bar and Control Center Icons +
2.5.2.2 Ensure Listen for (Siri) Is Disabled +
2.6.1.3 Audit Location Services Access +
2.6.2.1 Audit Full Disk Access for Applications +
2.6.3.5 Ensure Share iCloud Analytics Is Disabled +
@@ -27,10 +28,9 @@ discussion: |
2.10.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel) +
2.12.2 Audit Touch ID +
2.14.1 Audit Game Center Settings +
2.15.1 Audit Notification & Focus Settings +
2.15.1 Audit Notification Settings +
2.16.1 Audit Wallet & Apple Pay Settings +
2.17.1 Audit Internet Accounts for Authorized Use +
6.5.1 Audit Passwords System Preference Setting +
|===
[cols="15%h, 85%a"]
@@ -52,8 +52,7 @@ discussion: |
5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured +
5.2.5 Ensure Complex Password Must Contain Special Character Is Configured +
5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured +
5.3.1 Ensure All User Storage APFS Volumes are Encrypted +
5.3.2 Ensure All User Storage CoreStorage Volumes are Encrypted +
5.3.3 Audit Connected FAT32 and ExFAT Drives +
|===
[cols="15%h, 85%a"]
@@ -68,6 +67,7 @@ discussion: |
6.3.5 Audit Hide IP Address in Safari Setting +
6.3.8 Audit Autofill +
6.3.9 Audit Pop-up Windows +
6.5.1 Audit Passwords +
|===
references:
nist: {}

View File

@@ -10,16 +10,7 @@ discussion: |
|System Settings
|Recommendations
| 1.7 Ensure the System is Managed by a Mobile Device Management (MDM) Software
|===
[cols="15%h, 85%a"]
|===
|Section
|System Settings
|Recommendations
|2.1.1.1 Audit iCloud Keychain +
|2.1.1.1 Audit iCloud Passwords & Keychain +
2.1.1.2 Audit iCloud Drive +
2.1.1.4 Audit Security Keys Used With Apple Accounts +
2.1.1.5 Audit Freeform Sync to iCloud +
@@ -27,7 +18,7 @@ discussion: |
2.1.2 Audit App Store Password Settings +
2.3.3.11 Ensure Computer Name Does Not Contain PII or Protected Organizational Information +
2.4.1 Audit Menu Bar and Control Center Icons +
2.5.2.2 Ensure Listen for Siri is Disabled +
2.5.2.2 Ensure Listen for (Siri) Is Disabled +
2.6.1.3 Audit Location Services Access +
2.6.2.1 Audit Full Disk Access for Applications +
2.6.3.5 Ensure Share iCloud Analytics Is Disabled +
@@ -37,7 +28,7 @@ discussion: |
2.10.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel) +
2.12.2 Audit Touch ID +
2.14.1 Audit Game Center Settings +
2.15.1 Audit Notification & Focus Settings +
2.15.1 Audit Notification Settings +
2.16.1 Audit Wallet & Apple Pay Settings +
2.17.1 Audit Internet Accounts for Authorized Use +
|===
@@ -61,8 +52,7 @@ discussion: |
5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured +
5.2.5 Ensure Complex Password Must Contain Special Character Is Configured +
5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured +
5.3.1 Ensure All User Storage APFS Volumes are Encrypted +
5.3.2 Ensure All User Storage CoreStorage Volumes are Encrypted +
5.3.3 Audit Connected FAT32 and ExFAT Drives +
|===
[cols="15%h, 85%a"]