FileVault enforcement requires FileVault payload #30

New Issue

michael · 2026-01-19T18:28:58Z

michael commented

2026-01-19 18:28:58 +00:00

Originally created by @phaninder-scalefusion on GitHub.

Summary

FileVault subsettings are not applied if the FileVault payload itself is missing from the MDM configuration.

Steps to reproduce

Deploy FileVault-related compliance checks without including the FileVault payload.
Observe that subsettings are not enforced.

Operating System version

(macOS 13 / 14 / 15)

Intel or Apple Silicon

Both

Current behavior

Subsettings silently fail when FileVault payload is absent.

Expected behavior

Compliance should either:

Fail with a clear error when FileVault payload is missing, OR
Automatically ensure FileVault payload is always included.

Possible fix

Ensure FileVault payload is always delivered with any subsetting.

Originally created by @phaninder-scalefusion on GitHub. ### Summary FileVault subsettings are not applied if the FileVault payload itself is missing from the MDM configuration. ### Steps to reproduce 1. Deploy FileVault-related compliance checks without including the FileVault payload. 2. Observe that subsettings are not enforced. ### Operating System version (macOS 13 / 14 / 15) ### Intel or Apple Silicon Both ### Current behavior Subsettings silently fail when FileVault payload is absent. ### Expected behavior Compliance should either: - Fail with a clear error when FileVault payload is missing, OR - Automatically ensure FileVault payload is always included. ### Possible fix Ensure FileVault payload is always delivered with any subsetting.

michael closed this issue

2026-01-19 18:28:59 +00:00

michael commented

2026-01-19 18:28:59 +00:00

@phaninder-scalefusion commented on GitHub:

This is regarding the rule “system_settings_filevault_enforce”, which checks whether FileVault is enforced. However, it does not validate against the FileVault payload sent to the device.
Therefore, I suggest adding a note in the description to clarify that this rule does not enable FileVault, so that Admins are aware.

@phaninder-scalefusion commented on GitHub: This is regarding the rule “system_settings_filevault_enforce”, which checks whether FileVault is enforced. However, it does not validate against the FileVault payload sent to the device. Therefore, I suggest adding a note in the description to clarify that this rule does not enable FileVault, so that Admins are aware.

michael commented

2026-01-19 18:28:59 +00:00

@brodjieski commented on GitHub:

Hello! Which FileVault subsettings are you seeing this issue with? Are there specific rule files that are affected? I want to be able to accurately reproduce the issue so if there is any more additional information you can provide, that would be most helpful.

Thanks!

@brodjieski commented on GitHub: Hello! Which FileVault subsettings are you seeing this issue with? Are there specific rule files that are affected? I want to be able to accurately reproduce the issue so if there is any more additional information you can provide, that would be most helpful. Thanks!

michael commented

2026-01-19 18:28:59 +00:00

@brodjieski commented on GitHub:

Ahh, I see. Ok, so we do include the following in the fix of the rule yaml file, however, the guidance does not use this because it also has the mobileconfig_info.

fix: |
NOTE: See the FileVault supplemental to implement this rule.

We will have to move this NOTE to the discussion.

@brodjieski commented on GitHub: Ahh, I see. Ok, so we do include the following in the fix of the rule yaml file, however, the guidance does not use this because it also has the mobileconfig_info. fix: | NOTE: See the FileVault supplemental to implement this rule. We will have to move this NOTE to the discussion.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#30