Files
macos_security/rules/os/os_on_device_dictation_enforce.yaml
2025-11-06 12:03:22 -05:00

74 lines
1.4 KiB
YAML

id: os_on_device_dictation_enforce
title: Enforce On Device Dictation
discussion: |
Dictation _MUST_ be restricted to on device only to prevent potential data exfiltration.
The information system _MUST_ be configured to provide only essential capabilities.
IMPORTANT: This rule only applies to Apple Silicon devices.
check: |
/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('forceOnDeviceOnlyDictation').js
EOS
result:
string: 'true'
fix: |
This is implemented by a Configuration Profile.
references:
cce:
- CCE-95247-3
cci:
- CCI-000381
800-53r5:
- AC-20
- CM-7
- CM-7(1)
- SC-7(10)
800-53r4:
- CM-7
- CM-7(1)
- AC-20
srg:
- SRG-OS-000095-GPOS-00049
disa_stig:
- APPL-26-002220
800-171r3:
- 03.01.20
- 03.04.06
cis:
benchmark:
- 2.18.1 (level 1)
controls v8:
- 4.1
- 4.8
cmmc:
- AC.L1-3.1.20
- CM.L2-3.4.6
- CM.L2-3.4.7
macOS:
- '26.0'
tags:
- arm64
- 800-53r5_low
- 800-53r5_moderate
- 800-53r5_high
- 800-53r4_low
- 800-53r4_moderate
- 800-53r4_high
- 800-171
- cisv8
- cnssi-1253_low
- cnssi-1253_high
- cmmc_lvl2
- cmmc_lvl1
- stig
- cis_lvl1
- cis_lvl2
- cnssi-1253_moderate
severity: medium
mobileconfig: true
mobileconfig_info:
com.apple.applicationaccess:
forceOnDeviceOnlyDictation: true