usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-09-27 22:00:42 +01:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

feat(cis): map CIS Golden Gate 27 and Tahoe 26 v2.0.0 benchmarks

Browse Source 
macOS 27 had no CIS coverage. Adds Level 1 and Level 2 mappings for CIS
Apple macOS 27 Golden Gate v1.0.0, and maps the one recommendation new to
CIS Apple macOS Tahoe 26 v2.0.0.

  cis_lvl1_macos_27.0      0 -> 96
  cis_lvl2_macos_27.0      0 -> 117
  cis_lvl1_macos_26.0     97 -> 97
  cis_lvl2_macos_26.0    116 -> 118

116 rules receive references.cis.benchmark.macos_27 (118 references across
95 distinct recommendations). Applied via `./mscp.py admin import`.

Golden Gate carries 121 of the 125 published Tahoe v1.1.0 recommendations
unchanged, renumbers one, drops three, and adds none. Every change sits in
2.10 Battery and follows from macOS 27 dropping Intel support:

  2.10.1.1  OS Not Active When Resuming from Standby (Intel)  dropped
  2.10.1.2  Sleep and Display Sleep on Apple Silicon      -> 2.10.1
  2.10.2    Power Nap Disabled for Intel Macs                 dropped
  2.10.3    Wake for Network Access Is Disabled           -> 2.10.2

Version differences use the existing per-OS reference structure; no rule
modelling changed. Levels follow the established convention - level 1 tags
cis_lvl1 and cis_lvl2, level 2 tags cis_lvl2 alone - and all 95 mapped
recommendations were confirmed against their CIS Workbench pages.

2.3.5.1 (allowUIConfigurationProfileInstallation, Manual, Level 2) is new
in both benchmarks and maps to the existing
os_install_configuration_profile_disable, which already enforced that key
and additionally asserts objectIsForcedForKey.

supplemental_cis_manual was two revisions out of date. Drops 1.7 (in
neither benchmark) and 5.3.1/5.3.2 (Automated, with dedicated rules), adds
5.3.3 and 2.3.5.1, and corrects five titles.

Also corrects pre-existing defects surfaced by the mapping, in files the
mapping already touches:

  - system_settings_software_update_app_update_enforce and
    os_software_update_deferral had CIS references but no 26.0/27.0
    platform blocks, so CIS 1.4 and 1.6 could not enter the baselines
  - system_settings_improve_search_disable was missing "(level 1)"
  - system_settings_location_services_menu_enforce tagged a Level 2
    recommendation into cis_lvl1
  - os_internal_apfs_volumes_encrypted and
    os_external_apfs_hfs_volumes_encrypted listed CIS Controls v7 entries
    in controls_v8
This commit is contained in:
Tony Young
2026-09-02 09:45:51 -04:00
parent 6db78ab019
commit f0135b577d
125 changed files with 573 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/mscp/data/rules/audit/audit_acls_files_configure.yaml
View File

@@ -58,12 +58,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

6
src/mscp/data/rules/audit/audit_acls_folders_configure.yaml
View File

@@ -35,7 +35,7 @@ references:
- SRG-OS-000257-GPOS-00098
- SRG-OS-000258-GPOS-00099
- SRG-OS-000058-GPOS-00028
disa_stig:
disa_stig:
macos_27:
- APPL-27-000031
macos_26:
@@ -58,12 +58,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_auditd_enabled.yaml
View File

@@ -115,6 +115,8 @@ references:
- 3.1 (level 1)
macos_14:
- 3.1 (level 1)
macos_27:
- 3.1 (level 1)
controls_v8:
- 8.2
- 8.5
@@ -122,6 +124,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_control_acls_configure.yaml
View File

@@ -57,12 +57,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_control_group_configure.yaml
View File

@@ -57,12 +57,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_control_mode_configure.yaml
View File

@@ -57,12 +57,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_control_owner_configure.yaml
View File

@@ -57,12 +57,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_files_group_configure.yaml
View File

@@ -59,12 +59,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_files_mode_configure.yaml
View File

@@ -55,12 +55,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_files_owner_configure.yaml
View File

@@ -59,12 +59,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/audit/audit_flags_aa_configure.yaml
View File

@@ -71,6 +71,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -79,6 +81,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/audit/audit_flags_ad_configure.yaml
View File

@@ -92,6 +92,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -100,6 +102,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/audit/audit_flags_ex_configure.yaml
View File

@@ -61,6 +61,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -69,6 +71,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

6
src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml
View File

@@ -48,13 +48,17 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
- 8.5
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl2

3
src/mscp/data/rules/audit/audit_flags_fr_configure.yaml
View File

@@ -76,6 +76,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -84,6 +86,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/audit/audit_flags_fw_configure.yaml
View File

@@ -77,6 +77,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -85,6 +87,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/audit/audit_flags_lo_configure.yaml
View File

@@ -68,6 +68,8 @@ references:
- 3.2 (level 2)
macos_14:
- 3.2 (level 2)
macos_27:
- 3.2 (level 2)
controls_v8:
- 3.14
- 8.2
@@ -76,6 +78,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_folder_group_configure.yaml
View File

@@ -59,12 +59,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_folder_owner_configure.yaml
View File

@@ -59,12 +59,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_folders_mode_configure.yaml
View File

@@ -57,12 +57,16 @@ references:
- 3.5 (level 1)
macos_14:
- 3.5 (level 1)
macos_27:
- 3.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/audit/audit_retention_configure.yaml
View File

@@ -48,6 +48,8 @@ references:
- 3.4 (level 1)
macos_14:
- 3.4 (level 1)
macos_27:
- 3.4 (level 1)
controls_v8:
- 8.1
- 8.3
@@ -55,6 +57,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: low
'26.0':

1
src/mscp/data/rules/auth/auth_smartcard_allow.yaml
View File

@@ -56,7 +56,6 @@ references:
hhs:
hicp:
- 3.L.A
- ''
cis:
controls_v8:
- 6.3

1
src/mscp/data/rules/auth/auth_smartcard_enforce.yaml
View File

@@ -71,7 +71,6 @@ references:
hhs:
hicp:
- 3.L.A
- ''
cis:
controls_v8:
- 6.3

3
src/mscp/data/rules/icloud/icloud_sync_disable.yaml
View File

@@ -61,6 +61,8 @@ references:
- 2.1.1.3 (level 2)
macos_14:
- 2.1.1.3 (level 2)
macos_27:
- 2.1.1.3 (level 2)
controls_v8:
- 4.1
- 4.8
@@ -69,6 +71,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_airdrop_disable.yaml
View File

@@ -82,6 +82,8 @@ references:
- 2.3.1.1 (level 1)
macos_14:
- 2.3.1.1 (level 1)
macos_27:
- 2.3.1.1 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -98,6 +100,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/os/os_anti_virus_installed.yaml
View File

@@ -34,13 +34,18 @@ references:
- 5.10 (level 1)
macos_14:
- 5.10 (level 1)
macos_27:
- 5.10 (level 1)
controls_v8:
- 10.5
- 10.1
- 10.2
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/os/os_authenticated_root_enable.yaml
View File

@@ -65,6 +65,8 @@ references:
- 5.1.4 (level 1)
macos_14:
- 5.1.4 (level 1)
macos_27:
- 5.1.4 (level 1)
controls_v8:
- 3.6
- 3.11
@@ -72,6 +74,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/os/os_bonjour_disable.yaml
View File

@@ -47,6 +47,8 @@ references:
- 4.1 (level 2)
macos_14:
- 4.1 (level 2)
macos_27:
- 4.1 (level 2)
controls_v8:
- 4.1
- 4.8
@@ -54,6 +56,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_config_data_install_enforce.yaml
View File

@@ -53,6 +53,8 @@ references:
- 1.6 (level 1)
macos_14:
- 1.6 (level 1)
macos_27:
- 1.5 (level 1)
controls_v8:
- 7.3
- 7.4
@@ -65,6 +67,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

1
src/mscp/data/rules/os/os_dictation_disable.yaml
View File

@@ -57,7 +57,6 @@ references:
hhs:
hicp:
- 2.L.A
- ''
cis:
controls_v8:
- 4.1

8
src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml
View File

@@ -15,14 +15,18 @@ references:
benchmark:
macos_26:
- 5.3.2 (level 1)
macos_27:
- 5.3.2 (level 1)
controls_v8:
- 3.6
- 3.11
- 13.6
- 14.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

1
src/mscp/data/rules/os/os_firewall_default_deny_require.yaml
View File

@@ -37,7 +37,6 @@ references:
hhs:
hicp:
- 6.L.A
- ''
platforms:
macOS:
'27.0': {}

4
src/mscp/data/rules/os/os_gatekeeper_enable.yaml
View File

@@ -65,6 +65,8 @@ references:
- 2.6.5 (level 1)
macos_14:
- 2.6.5 (level 1)
macos_27:
- 2.6.5 (level 1)
controls_v8:
- 10.1
- 10.2
@@ -73,6 +75,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: high
'26.0':

7
src/mscp/data/rules/os/os_guest_folder_removed.yaml
View File

@@ -21,11 +21,16 @@ references:
- 5.9 (level 1)
macos_14:
- 5.9 (level 1)
macos_27:
- 5.9 (level 1)
controls_v8:
- 4.1
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/os/os_home_folders_secure.yaml
View File

@@ -55,12 +55,16 @@ references:
- 5.1.1 (level 1)
macos_14:
- 5.1.1 (level 1)
macos_27:
- 5.1.1 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_httpd_disable.yaml
View File

@@ -52,6 +52,8 @@ references:
- 4.2 (level 1)
macos_14:
- 4.2 (level 1)
macos_27:
- 4.2 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -59,6 +61,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

12
src/mscp/data/rules/os/os_install_configuration_profile_disable.yaml
View File

@@ -58,6 +58,10 @@ references:
- 8.27
cis:
benchmark:
macos_27:
- 2.3.5.1 (level 2)
macos_26:
- 2.3.5.1 (level 2)
ios_26:
- 3.2.1.15 (level 1 - Institutionally-Owned Devices)
ios_18:
@@ -68,8 +72,12 @@ references:
- 4.1
platforms:
macOS:
'27.0': {}
'26.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl2
'15.0': {}
enforcement_info:
check:

4
src/mscp/data/rules/os/os_install_log_retention_configure.yaml
View File

@@ -46,6 +46,8 @@ references:
- 3.3 (level 1)
macos_14:
- 3.3 (level 1)
macos_27:
- 3.3 (level 1)
controls_v8:
- 8.1
- 8.3
@@ -53,6 +55,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

9
src/mscp/data/rules/os/os_internal_apfs_volumes_encrypted.yaml
View File

@@ -15,14 +15,17 @@ references:
benchmark:
macos_26:
- 5.3.1 (level 1)
macos_27:
- 5.3.1 (level 1)
controls_v8:
- 3.6
- 3.11
- 13.6
- 14.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_mail_summary_disable.yaml
View File

@@ -49,6 +49,8 @@ references:
ios_26:
- 2.9.3 (level 1 - End-User Owned Devices)
- 3.10.3 (level 1 - Institutionally-Owned Devices)
macos_27:
- 2.5.1.3 (level 1)
bsi:
indigo:
ios_26:
@@ -57,7 +59,10 @@ references:
- ANNEX K
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_mobile_file_integrity_enable.yaml
View File

@@ -20,12 +20,17 @@ references:
- 5.1.3 (level 1)
macos_14:
- 5.1.3 (level 1)
macos_27:
- 5.1.3 (level 1)
controls_v8:
- 2.3
- 2.6
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/os/os_nfsd_disable.yaml
View File

@@ -51,6 +51,8 @@ references:
- 4.3 (level 1)
macos_14:
- 4.3 (level 1)
macos_27:
- 4.3 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -58,6 +60,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/os/os_notes_transcription_disable.yaml
View File

@@ -46,13 +46,18 @@ references:
- 2.5.1.4 (level 1)
macos_15:
- 2.5.1.4 (level 1)
macos_27:
- 2.5.1.4 (level 1)
bsi:
indigo:
ios_26:
- ANNEX K
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml
View File

@@ -49,13 +49,18 @@ references:
ios_26:
- 2.9.2 (level 1 - End-User Owned Devices)
- 3.10.2 (level 1 - Institutionally-Owned Devices)
macos_27:
- 2.5.1.4 (level 1)
bsi:
indigo:
ios_26:
- ANNEX K
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

1
src/mscp/data/rules/os/os_obscure_password.yaml
View File

@@ -35,7 +35,6 @@ references:
hicp:
- 2.L.B
- 3.L.B
- ''
cis:
controls_v8:
- 4.1

6
src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml
View File

@@ -77,6 +77,8 @@ references:
- 2.18.1 (level 1)
macos_14:
- 2.18.1 (level 1)
macos_27:
- 2.18.1 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -92,6 +94,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':
@@ -148,7 +152,7 @@ platforms:
introduced: '14.5'
visionOS:
'27.0':
supervised: false
supervised: false
'26.0':
supervised: false
benchmarks:

4
src/mscp/data/rules/os/os_password_hint_remove.yaml
View File

@@ -45,12 +45,16 @@ references:
- 2.12.1 (level 1)
macos_14:
- 2.11.1 (level 1)
macos_27:
- 2.12.1 (level 1)
controls_v8:
- 5.2
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml
View File

@@ -60,12 +60,15 @@ references:
- 5.8 (level 2)
macos_14:
- 5.8 (level 2)
macos_27:
- 5.8 (level 2)
controls_v8:
- 4.1
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_root_disable.yaml
View File

@@ -54,12 +54,16 @@ references:
- 5.6 (level 1)
macos_14:
- 5.6 (level 1)
macos_27:
- 5.6 (level 1)
controls_v8:
- 5.4
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml
View File

@@ -25,11 +25,16 @@ references:
- 6.3.6 (level 1)
macos_14:
- 6.3.6 (level 1)
macos_27:
- 6.3.6 (level 1)
controls_v8:
- 9.1
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml
View File

@@ -25,12 +25,17 @@ references:
- 6.3.1 (level 1)
macos_14:
- 6.3.1 (level 1)
macos_27:
- 6.3.1 (level 1)
controls_v8:
- 9.1
- 9.6
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml
View File

@@ -25,12 +25,17 @@ references:
- 6.3.4 (level 1)
macos_14:
- 6.3.4 (level 1)
macos_27:
- 6.3.4 (level 1)
controls_v8:
- 9.1
- 9.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml
View File

@@ -25,11 +25,16 @@ references:
- 6.3.7 (level 1)
macos_14:
- 6.3.7 (level 1)
macos_27:
- 6.3.7 (level 1)
controls_v8:
- 9.1
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml
View File

@@ -25,11 +25,16 @@ references:
- 6.3.10 (level 1)
macos_14:
- 6.3.10 (level 1)
macos_27:
- 6.3.10 (level 1)
controls_v8:
- 9.1
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml
View File

@@ -25,12 +25,17 @@ references:
- 6.3.3 (level 1)
macos_14:
- 6.3.3 (level 1)
macos_27:
- 6.3.3 (level 1)
controls_v8:
- 9.1
- 9.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/os/os_sip_enable.yaml
View File

@@ -95,6 +95,8 @@ references:
- 5.1.2 (level 1)
macos_14:
- 5.1.2 (level 1)
macos_27:
- 5.1.2 (level 1)
controls_v8:
- 2.3
- 2.6
@@ -103,6 +105,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: high
'26.0':

6
src/mscp/data/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml
View File

@@ -21,11 +21,15 @@ references:
- 2.10.1.1 (level 2)
macos_14:
- 2.9.1.2 (level 2)
macos_27:
- 2.10.1 (level 2)
controls_v8:
- 4.1
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl2

8
src/mscp/data/rules/os/os_software_update_deferral.yaml
View File

@@ -7,6 +7,8 @@ discussion: |
references:
nist:
cce:
macos_27:
- CCE-XXXXX-X
macos_26:
- CCE-95303-4
macos_15:
@@ -21,11 +23,17 @@ references:
- 1.7 (level 1)
macos_14:
- 1.7 (level 1)
macos_27:
- 1.6 (level 1)
controls_v8:
- 7.3
- 7.4
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/os/os_sudo_log_enforce.yaml
View File

@@ -41,10 +41,14 @@ references:
- 5.11 (level 1)
macos_15:
- 5.11 (level 1)
macos_27:
- 5.11 (level 1)
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_sudo_timeout_configure.yaml
View File

@@ -39,12 +39,16 @@ references:
- 5.4 (level 1)
macos_14:
- 5.4 (level 1)
macos_27:
- 5.4 (level 1)
controls_v8:
- 4.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml
View File

@@ -47,12 +47,16 @@ references:
- 5.5 (level 1)
macos_14:
- 5.5 (level 1)
macos_27:
- 5.5 (level 1)
controls_v8:
- 4.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/os/os_system_wide_applications_configure.yaml
View File

@@ -21,11 +21,16 @@ references:
- 5.1.5 (level 1)
macos_14:
- 5.1.5 (level 1)
macos_27:
- 5.1.5 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml
View File

@@ -25,11 +25,16 @@ references:
- 6.4.1 (level 1)
macos_14:
- 6.4.1 (level 1)
macos_27:
- 6.4.1 (level 1)
controls_v8:
- 4.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

1
src/mscp/data/rules/os/os_tftpd_disable.yaml
View File

@@ -55,7 +55,6 @@ references:
- 2.L.A
- 3.L.C
- 4.L.A
- ''
cis:
controls_v8:
- 3.3

4
src/mscp/data/rules/os/os_time_server_enabled.yaml
View File

@@ -53,12 +53,16 @@ references:
- 2.3.2.2 (level 1)
macos_14:
- 2.3.2.2 (level 1)
macos_27:
- 2.3.2.2 (level 1)
controls_v8:
- 8.4
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml
View File

@@ -56,12 +56,16 @@ references:
- 5.7 (level 1)
macos_14:
- 5.7 (level 1)
macos_27:
- 5.7 (level 1)
controls_v8:
- 4.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

6
src/mscp/data/rules/os/os_world_writable_library_folder_configure.yaml
View File

@@ -23,11 +23,15 @@ references:
- 5.1.7 (level 2)
macos_14:
- 5.1.7 (level 2)
macos_27:
- 5.1.7 (level 2)
controls_v8:
- 3.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl2

7
src/mscp/data/rules/os/os_world_writable_system_folder_configure.yaml
View File

@@ -21,11 +21,16 @@ references:
- 5.1.6 (level 1)
macos_14:
- 5.1.6 (level 1)
macos_27:
- 5.1.6 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

6
src/mscp/data/rules/os/os_writing_tools_disable.yaml
View File

@@ -61,6 +61,8 @@ references:
ios_26:
- 2.9.4 (level 1 - End-User Owned Devices)
- 3.10.4 (level 1 - Institutionally-Owned Devices)
macos_27:
- 2.5.1.2 (level 1)
bsi:
indigo:
ios_26:
@@ -71,6 +73,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':
@@ -85,7 +89,7 @@ platforms:
- name: disa_stig
enforcement_info:
check:
shell: |-
shell: |-
/usr/bin/osascript -l JavaScript -e 'var s = $.NSUserDefaults.alloc.initWithSuiteName("com.apple.applicationaccess"); (ObjC.unwrap(s.objectForKey("allowWritingTools")) == false && s.objectIsForcedForKey("allowWritingTools")) ? "PASS" : "FAIL"'
result:
string: 'PASS'

4
src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml
View File

@@ -75,6 +75,8 @@ references:
ios_17:
- 2.4.6 (level 1 - End-User Owned Devices)
- 3.4.6 (level 1 - Institutionally-Owned Devices)
macos_27:
- 5.2.1 (level 1)
controls_v8:
- 6.2
bsi:
@@ -92,6 +94,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml
View File

@@ -45,12 +45,16 @@ references:
- 5.2.1 (level 1)
macos_14:
- 5.2.1 (level 1)
macos_27:
- 5.2.1 (level 1)
controls_v8:
- 6.2
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml
View File

@@ -64,6 +64,9 @@ references:
macos_14:
- 5.2.3 (level 2)
- 5.2.4 (level 2)
macos_27:
- 5.2.3 (level 2)
- 5.2.4 (level 2)
controls_v8:
- 5.2
bsi:
@@ -81,6 +84,7 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml
View File

@@ -59,12 +59,15 @@ references:
- 5.2.6 (level 2)
macos_14:
- 5.2.6 (level 2)
macos_27:
- 5.2.6 (level 2)
controls_v8:
- 5.2
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml
View File

@@ -66,6 +66,8 @@ references:
- 5.2.8 (level 1)
macos_14:
- 5.2.8 (level 1)
macos_27:
- 5.2.8 (level 1)
controls_v8:
- 5.2
bsi:
@@ -81,7 +83,10 @@ references:
- ANNEX K
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml
View File

@@ -52,12 +52,16 @@ references:
- 5.2.7 (level 1)
macos_14:
- 5.2.7 (level 1)
macos_27:
- 5.2.7 (level 1)
controls_v8:
- 5.3
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml
View File

@@ -86,6 +86,8 @@ references:
ios_17:
- 2.4.3 (level 1 - End-User Owned Devices)
- 3.4.3 (level 1 - Institutionally-Owned Devices)
macos_27:
- 5.2.2 (level 1)
controls_v8:
- 5.2
bsi:
@@ -103,6 +105,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml
View File

@@ -54,12 +54,15 @@ references:
- 5.2.5 (level 2)
macos_14:
- 5.2.5 (level 2)
macos_27:
- 5.2.5 (level 2)
controls_v8:
- 5.2
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

32
src/mscp/data/rules/supplemental/supplemental_cis_manual.yaml
View File

@@ -10,34 +10,26 @@ discussion: |
|System Settings
|Recommendations
| 1.7 Ensure the System is Managed by a Mobile Device Management (MDM) Software
|===
[cols="15%h, 85%a"]
|===
|Section
|System Settings
|Recommendations
|2.1.1.1 Audit iCloud Keychain +
|2.1.1.1 Audit iCloud Passwords & Keychain +
2.1.1.2 Audit iCloud Drive +
2.1.1.4 Audit Security Keys Used With Apple Accounts +
2.1.1.5 Audit Freeform Sync to iCloud +
2.1.1.6 Audit Find My Mac +
2.1.2 Audit App Store Password Settings +
2.1.2 Audit App Store Password Settings (macOS 27 only) +
2.3.3.11 Ensure Computer Name Does Not Contain PII or Protected Organizational Information +
2.3.5.1 Ensure 'allowUIConfigurationProfileInstallation' Is Set to Disabled +
2.4.1 Audit Menu Bar and Control Center Icons +
2.5.2.2 Ensure Listen for Siri is Disabled +
2.5.2.2 Ensure Listen for (Siri) Is Disabled +
2.6.1.3 Audit Location Services Access +
2.6.2.1 Audit Full Disk Access for Applications +
2.6.3.5 Ensure Share iCloud Analytics Is Disabled +
2.6.7 Audit Lockdown Mode +
2.7.2 Audit iPhone Mirroring +
2.8.1 Audit Universal Control Settings +
2.10.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel) +
2.10.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel) (macOS 26 and earlier) +
2.12.2 Audit Touch ID +
2.14.1 Audit Game Center Settings +
2.15.1 Audit Notification & Focus Settings +
2.15.1 Audit Notification Settings +
2.16.1 Audit Wallet & Apple Pay Settings +
2.17.1 Audit Internet Accounts for Authorized Use +
|===
@@ -61,8 +53,7 @@ discussion: |
5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured +
5.2.5 Ensure Complex Password Must Contain Special Character Is Configured +
5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured +
5.3.1 Ensure All User Storage APFS Volumes are Encrypted +
5.3.2 Ensure All User Storage CoreStorage Volumes are Encrypted +
5.3.3 Audit Connected FAT32 and ExFAT Drives +
|===
[cols="15%h, 85%a"]
@@ -71,11 +62,11 @@ discussion: |
|Applications
|Recommendations
|6.1.1 Ensure Show All Filename Extensions Setting is Enabled +
|6.1.1 Audit Show All Filename Extensions +
6.2.1 Ensure Protect Mail Activity in Mail Is Enabled +
6.3.2 Audit History and Remove History Items +
6.3.5 Audit Hide IP Address in Safari Setting +
6.3.8 Audit Autofill +
6.3.8 Audit AutoFill +
6.3.9 Audit Pop-up Windows +
6.5.1 Audit Passwords +
|===
@@ -83,7 +74,10 @@ references:
nist: {}
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml
View File

@@ -54,6 +54,8 @@ references:
- 2.3.1.2 (level 1)
macos_14:
- 2.3.1.2 (level 1)
macos_27:
- 2.3.1.2 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -61,6 +63,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml
View File

@@ -51,12 +51,16 @@ references:
- 2.13.3 (level 1)
macos_14:
- 2.12.3 (level 1)
macos_27:
- 2.13.3 (level 1)
controls_v8:
- 4.7
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

1
src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml
View File

@@ -39,7 +39,6 @@ references:
hicp:
- 2.L.B
- 3.L.B
- ''
cis:
controls_v8:
- 4.1

4
src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml
View File

@@ -61,6 +61,8 @@ references:
- 2.3.3.10 (level 1)
macos_14:
- 2.3.3.10 (level 1)
macos_27:
- 2.3.3.10 (level 1)
controls_v8:
- 3.3
- 4.1
@@ -68,6 +70,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

3
src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml
View File

@@ -48,12 +48,15 @@ references:
- 2.3.3.8 (level 2)
macos_14:
- 2.3.3.8 (level 2)
macos_27:
- 2.3.3.8 (level 2)
controls_v8:
- 4.8
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml
View File

@@ -29,6 +29,8 @@ references:
- 1.6 (level 1)
macos_14:
- 1.6 (level 1)
macos_27:
- 1.5 (level 1)
controls_v8:
- 7.3
- 7.4
@@ -45,7 +47,10 @@ references:
- 7.L.B
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
enforcement_info:
check:

5
src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml
View File

@@ -56,6 +56,9 @@ references:
- 2.6.3.4 (level 1)
macos_14:
- 2.6.3 (level 2)
macos_27:
- 2.6.3.1 (level 1)
- 2.6.3.4 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -63,6 +66,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

12
src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml
View File

@@ -24,7 +24,7 @@ references:
visionos_27:
- CCE-XXXXX-X
visionos_26:
- CCE-95573-2
- CCE-95573-2
800-53r5:
- AC-20
- CM-7
@@ -55,7 +55,7 @@ references:
- AC.L1-3.1.20
- AU.L2-3.3.3
- CM.L2-3.4.1
- CM.L2-3.4.2
- CM.L2-3.4.2
- CM.L2-3.4.6
- CM.L2-3.4.7
hhs:
@@ -68,6 +68,8 @@ references:
- 2.5.1.1 (level 1)
macos_15:
- 2.5.1.1 (level 1)
macos_27:
- 2.5.1.1 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -75,11 +77,13 @@ references:
bsi:
indigo:
ios_26:
- ANNEX K
- ANNEX K
platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':
@@ -121,7 +125,7 @@ platforms:
benchmarks:
- name: visionos_stig
severity: medium
introduced: '2.4'
introduced: '2.4'
tags:
- 800-53r5_low
- 800-53r5_moderate

18
src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml
View File

@@ -22,9 +22,9 @@ references:
visionos_27:
- CCE-XXXXX-X
visionos_26:
- CCE-95574-0
- CCE-95574-0
800-53r5:
- CM-6
- CM-6
- AC-20
- CM-7
- CM-7(1)
@@ -47,9 +47,9 @@ references:
visionos_26:
- AVOS-26-015400
sfr:
- 'FMT_MOF_EXT.1.2 #47'
- 'FMT_MOF_EXT.1.2 #47'
cmmc:
- AC.L1-B.1.III
- AC.L1-B.1.III
- AC.L1-3.1.20
- AU.L2-3.3.3
- CM.L2-3.4.1
@@ -59,7 +59,7 @@ references:
bsi:
indigo:
ios_26:
- ANNEX K
- ANNEX K
bzk:
bio:
- 8.12
@@ -76,7 +76,9 @@ references:
- 2.5.1.1 (level 1)
ios_26:
- 2.9.1 (level 1 - End-User Owned Devices)
- 3.10.1 (level 1 - Institutionally-Owned Devices)
- 3.10.1 (level 1 - Institutionally-Owned Devices)
macos_27:
- 2.5.1.1 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -85,6 +87,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':
@@ -132,7 +136,7 @@ platforms:
benchmarks:
- name: visionos_stig
severity: medium
introduced: '2.4'
introduced: '2.4'
tags:
- 800-53r5_low
- 800-53r5_moderate

12
src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml
View File

@@ -1,12 +1,12 @@
id: system_settings_filevault_enforce
title: Enforce FileVault
discussion: |
discussion: |
FileVault _MUST_ be enabled.
On Mac computers with Apple silicon or the Apple T2 Security Chip, internal storage is encrypted by default. Enabling FileVault provides additional protection by requiring an authorized user's credentials or a valid recovery key to unlock the data volume during the boot process.
When FileVault is enabled, the volume encryption key is protected by both the hardware UID and the user's credentials. This protects data at rest against unauthorized access if the device is lost, stolen, or otherwise removed from a controlled area.
NOTE: See the FileVault supplemental guidance for implementation and recovery-key escrow requirements.
references:
nist:
@@ -63,6 +63,8 @@ references:
- 2.6.6 (level 1)
macos_14:
- 2.6.6 (level 1)
macos_27:
- 2.6.6 (level 1)
controls_v8:
- 3.6
- 3.11
@@ -70,6 +72,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: high
'26.0':

4
src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml
View File

@@ -60,6 +60,8 @@ references:
- 2.2.1 (level 1)
macos_14:
- 2.2.1 (level 1)
macos_27:
- 2.2.1 (level 1)
controls_v8:
- 4.1
- 4.5
@@ -68,6 +70,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml
View File

@@ -49,13 +49,18 @@ references:
- 2.2.2 (level 1)
macos_14:
- 2.2.2 (level 1)
macos_27:
- 2.2.2 (level 1)
controls_v8:
- 4.1
- 4.5
- 4.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

7
src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml
View File

@@ -31,11 +31,16 @@ references:
- 2.13.2 (level 1)
macos_14:
- 2.12.2 (level 1)
macos_27:
- 2.13.2 (level 1)
controls_v8:
- 3.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml
View File

@@ -54,6 +54,8 @@ references:
- 2.13.1 (level 1)
macos_14:
- 2.12.1 (level 1)
macos_27:
- 2.13.1 (level 1)
controls_v8:
- 5.2
- 6.2
@@ -62,6 +64,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

7
src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml
View File

@@ -37,11 +37,16 @@ references:
- 2.7.1 (level 2)
macos_14:
- 2.7.1 (level 2)
macos_27:
- 2.7.1 (level 1)
controls_v8:
- 4.3
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1

4
src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml
View File

@@ -51,6 +51,8 @@ references:
- 2.6.3.3 (level 1)
macos_15:
- 2.6.3.3 (level 1)
macos_27:
- 2.6.3.3 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -58,6 +60,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

6
src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml
View File

@@ -47,9 +47,11 @@ references:
cis:
benchmark:
macos_26:
- 2.9.1
- 2.9.1 (level 1)
macos_15:
- 2.9.1 (level 1)
macos_27:
- 2.9.1 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -57,6 +59,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

4
src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml
View File

@@ -57,6 +57,8 @@ references:
- 2.6.3.2 (level 1)
macos_14:
- 2.6.3 (level 2)
macos_27:
- 2.6.3.2 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -64,6 +66,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

19
src/mscp/data/rules/system_settings/system_settings_install_macos_updates_enforce.yaml
View File

@@ -16,7 +16,7 @@ references:
ios_27:
- CCE-XXXXX-X
ios_26:
- CCE-96731-5
- CCE-96731-5
cis:
benchmark:
macos_26:
@@ -25,6 +25,8 @@ references:
- 1.4 (level 1)
macos_14:
- 1.4 (level 1)
macos_27:
- 1.3 (level 1)
controls_v8:
- 7.3
- 7.4
@@ -34,7 +36,10 @@ references:
- 8.08.01
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'26.0':
enforcement_info:
check:
@@ -59,12 +64,12 @@ platforms:
mobileconfig_info:
- PayloadType: com.apple.SoftwareUpdate
PayloadContent:
- AutomaticallyInstallMacOSUpdates: true
- AutomaticallyInstallMacOSUpdates: true
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: nlmapgov_plus
- name: nlmapgov_base
- name: nlmapgov_base
'15.0':
enforcement_info:
check:
@@ -78,7 +83,7 @@ platforms:
mobileconfig_info:
- PayloadType: com.apple.SoftwareUpdate
PayloadContent:
- AutomaticallyInstallMacOSUpdates: true
- AutomaticallyInstallMacOSUpdates: true
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
@@ -90,8 +95,8 @@ platforms:
result:
integer: 1
fix:
additional_info: This is implemented by Declarative Device Management (DDM).
additional_info: This is implemented by Declarative Device Management (DDM).
introduced: '10.15'
iOS:
'27.0': {}

4
src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml
View File

@@ -54,6 +54,8 @@ references:
- 2.3.3.7 (level 1)
macos_14:
- 2.3.3.7 (level 1)
macos_27:
- 2.3.3.7 (level 1)
controls_v8:
- 4.1
- 4.8
@@ -61,6 +63,8 @@ platforms:
macOS:
'27.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
- name: disa_stig
severity: medium
'26.0':

6
src/mscp/data/rules/system_settings/system_settings_location_services_enable.yaml
View File

@@ -21,12 +21,16 @@ references:
- 2.6.1.1 (level 2)
macos_14:
- 2.6.1.1 (level 2)
macos_27:
- 2.6.1.1 (level 2)
controls_v8:
- 4.1
- 4.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl2

8
src/mscp/data/rules/system_settings/system_settings_location_services_menu_enforce.yaml
View File

@@ -21,19 +21,21 @@ references:
- 2.6.1.2 (level 2)
macos_14:
- 2.6.1.2 (level 2)
macos_27:
- 2.6.1.2 (level 2)
controls_v8:
- 4.1
- 4.8
platforms:
macOS:
'27.0': {}
'27.0':
benchmarks:
- name: cis_lvl2
'26.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
'15.0':
benchmarks:
- name: cis_lvl1
- name: cis_lvl2
enforcement_info:
check:

Some files were not shown because too many files have changed in this diff Show More