usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Include check that FileVault cannot be disabled in system_settings_filevault_enforce or create new rule to check #200

New Issue
Closed
opened 2026-01-19 18:29:37 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:29:37 +00:00
Owner
Copy Link

Originally created by @moose-juice on GitHub.

Originally assigned to: @robertgendler on GitHub.

Problem to solve

Include a check that FileVault cannot be disabled. CIS macOS 13 Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled requires that FileVault is enabled and cannot be disabled. Its check and remediation include confirming FileVault cannot be disabled.

Intended users

macOS administrators hardening computers to the CIS macOS 13.0 Ventura Benchmark v1.0.0.

Further details

Administrators and organizations who wish to audit whether FileVault can be disabled will benefit from having this check included in the mSCP.

Proposal

Add the following check to the system_settings_filevault_enforce rule, or create a new rule that includes the following check.

Map whichever rule that includes this check back to CIS macOS 13.0 Ventura Benchmark v1.0.0 Level 1 2.6.5 Ensure FileVault is Enabled.

`
/usr/bin/sudo /usr/bin/osascript -l JavaScript << EOS.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable').js EOS

true
`

Documentation

CIS macOS 13.0 Ventura Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled

Testing

Risk of including an automated script check that will break the generated compliance script. Risk of including an automated script check that produces false positives or false negatives.

What does success look like, and how can we measure that?

Success is defined by the inclusion of an automated check/audit process to ensure FileVault cannot be disabled.

Links / references

CIS macOS 13.0 Ventura Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled

Originally created by @moose-juice on GitHub. Originally assigned to: @robertgendler on GitHub. ### Problem to solve Include a check that FileVault cannot be disabled. CIS macOS 13 Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled requires that FileVault is enabled and cannot be disabled. Its check and remediation include confirming FileVault cannot be disabled. ### Intended users macOS administrators hardening computers to the CIS macOS 13.0 Ventura Benchmark v1.0.0. ### Further details Administrators and organizations who wish to audit whether FileVault can be disabled will benefit from having this check included in the mSCP. ### Proposal Add the following check to the system_settings_filevault_enforce rule, or create a new rule that includes the following check. Map whichever rule that includes this check back to CIS macOS 13.0 Ventura Benchmark v1.0.0 Level 1 2.6.5 Ensure FileVault is Enabled. ` $ /usr/bin/sudo /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable').js EOS -- true ` ### Documentation CIS macOS 13.0 Ventura Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled ### Testing Risk of including an automated script check that will break the generated compliance script. Risk of including an automated script check that produces false positives or false negatives. ### What does success look like, and how can we measure that? Success is defined by the inclusion of an automated check/audit process to ensure FileVault cannot be disabled. ### Links / references CIS macOS 13.0 Ventura Benchmark v1.0.0 2.6.5 Ensure FileVault is Enabled
michael commented 2026-01-19 18:29:38 +00:00
Author
Owner
Copy Link

@jmahlman commented on GitHub:

Attaching link: https://workbench.cisecurity.org/sections/1447537/recommendations/2326211

@jmahlman commented on GitHub: Attaching link: https://workbench.cisecurity.org/sections/1447537/recommendations/2326211
michael commented 2026-01-19 18:29:38 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Please check to make sure this works.

We'll migrate it to Big Sur and Monterey if all is good.

@robertgendler commented on GitHub: Please check to make sure this works. We'll migrate it to Big Sur and Monterey if all is good.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#200
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?