first monty rules

rules/icloud/icloud_private_relay_disable.yaml

@@ -0,0 +1,48 @@
+id: icloud_private_relay_disable
+title: "Disable iCloud Private Relay"
+discussion: |
+check: |
+  /usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'allowCloudPrivateRelay = 0'
+result:
+  integer: 1
+fix: |
+  This is implemented by a Configuration Profile.
+references:
+  cce:
+    - N/A
+  cci:
+    - N/A
+  800-53r5:
+    - AC-20
+    - AC-20(1)
+    - CM-7
+    - CM-7(1)
+    - SC-7(10)    
+  800-53r4:
+    - CM-7
+    - CM-7(1)
+    - AC-20
+    - AC-20(1)
+  srg:
+    - N/A
+  disa_stig:
+    - APPL-12-XXXXXX
+  800-171r2:
+    - N/A
+macOS:
+  - "12.0"
+tags:
+  - 800-53r5_low
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - 800-53r4_low
+  - 800-53r4_moderate
+  - 800-53r4_high
+  - 800-171
+  - cnssi-1253
+  - stig
+severity: "medium"
+mobileconfig: true
+mobileconfig_info:
+  com.apple.applicationaccess:
+    allowCloudPrivateRelay: false

rules/os/os_recovery_lock_enable.yaml

@@ -0,0 +1,40 @@
+id: os_recovery_lock_enable
+title: "Enable Recovery Lock"
+discussion: |
+  A recovery lock password _MUST_ be enabled and set. 
+
+  NOTE: Recovery lock passwords are not supported on Intel devices.
+check: |
+  /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "IsRecoveryLockedEnabled = 1"
+result: 
+  integer: 1
+fix: |
+   NOTE: The SetRecoveryLock command can be used to set a Recovery Lock password.
+references:
+  cce:
+    - N/A
+  cci:
+    - N/A
+  800-53r5:
+    - AC-6
+  800-53r4:
+    - AC-6
+  srg:
+    - N/A
+  disa_stig:
+    - APPL-12-XXXXXX
+  800-171r2:
+    - 3.1.5
+macOS:
+  - "12.0"
+tags:
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - 800-53r4_moderate
+  - 800-53r4_high
+  - 800-171
+  - cnssi-1253
+  - stig
+severity: "medium"
+mobileconfig: false
+mobileconfig_info:

rules/os/os_skip_unlock_with_watch_enabled.yaml

@@ -0,0 +1,44 @@
+id: os_skip_unlock_with_watch_enabled
+title: "Disable Unlock with Apple Watch During Setup Assistant"
+discussion: |
+  The prompt for Apple Watch unlock setup during Setup Assistant _MUST_ be disabled. 
+  
+  Disabling Apple watches is a necessary step to ensuring that the information system retains a session lock until the user reestablishes access using an authorized identification and authentication procedures.
+check: | 
+  /usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'SkipUnlockWithWatch = 1'
+result:
+  integer: 1
+fix: |
+  This is implemented by a Configuration Profile.
+references:
+  cce:
+    - N/A
+  cci:
+    - CCI-000381
+  800-53r5:
+    - AC-20
+  800-53r4: 
+    - AC-20
+  srg: 
+    - N/A
+  disa_stig: 
+    - APPL-12-XXXXXX
+  800-171r2:
+    - 3.1.20
+macOS:
+  - "12.0"
+tags:
+  - 800-53r5_low
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - 800-53r4_low
+  - 800-53r4_moderate
+  - 800-53r4_high
+  - 800-171
+  - cnssi-1253
+  - stig
+severity: "medium"
+mobileconfig: true
+mobileconfig_info:
+  com.apple.SetupAssistant.managed:
+    SkipUnlockWithWatch: true

rules/sysprefs/sysprefs_airplay_receive_disable.yaml

@@ -0,0 +1,32 @@
+id: sysprefs_airplay_receiver_disable
+title: "Disable Airplay Receiver"
+discussion: |
+check: |
+  /usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AirplayRecieverEnabled = 0'
+result:
+  integer: 1
+fix: |
+  This is implemented by a Configuration Profile.
+references:
+  cce:
+    - N/A
+  cci: 
+    - N/A
+  800-53r5:
+    - N/A
+  800-53r4: 
+    - N/A
+  srg: 
+    - N/A
+  disa_stig: 
+    - N/A
+  800-171r2:
+    - N/A
+macOS:
+  - "12.0"
+tags:
+  - none
+mobileconfig: true
+mobileconfig_info:
+  com.apple.controlcenter:
+    AirplayRecieverEnabled: false