APPL-11-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

CAT|II

CCI|CCI-000056

Rule-ID|SV-230743r599842_rule

STIG-ID|APPL-11-000001

Vuln-ID|V-230743

APPL-11-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-230744r599842_rule

STIG-ID|APPL-11-000002

Vuln-ID|V-230744

APPL-11-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-230745r599842_rule

STIG-ID|APPL-11-000003

Vuln-ID|V-230745

APPL-11-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-230746r599842_rule

STIG-ID|APPL-11-000004

Vuln-ID|V-230746

APPL-11-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-230747r599842_rule

STIG-ID|APPL-11-000005

Vuln-ID|V-230747

APPL-11-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CAT|III

CCI|CCI-000060

Rule-ID|SV-230748r599842_rule

STIG-ID|APPL-11-000006

Vuln-ID|V-230748

APPL-11-000007 - The macOS system must be configured to disable hot corners - bottom left

Rule-ID|SV-230749r599842_rule

STIG-ID|APPL-11-000007

Vuln-ID|V-230749

APPL-11-000007 - The macOS system must be configured to disable hot corners - bottom right

APPL-11-000007 - The macOS system must be configured to disable hot corners - top left

APPL-11-000007 - The macOS system must be configured to disable hot corners - top right

APPL-11-000008 - The macOS system must be configured with Wi-Fi support software disabled.

CCI|CCI-001443

CCI|CCI-001444

CCI|CCI-001967

Rule-ID|SV-230750r599842_rule

STIG-ID|APPL-11-000008

Vuln-ID|V-230750

APPL-11-000011 - The macOS system must disable the SSHD service.

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-230751r599842_rule

STIG-ID|APPL-11-000011

Vuln-ID|V-230751

APPL-11-000012 - The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-230752r599842_rule

STIG-ID|APPL-11-000012

Vuln-ID|V-230752

APPL-11-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-230753r599842_rule

STIG-ID|APPL-11-000014

Vuln-ID|V-230753

APPL-11-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

APPL-11-000015 - The macOS system must utilize an Endpoint Security Solution (ESS) and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-230754r802346_rule

STIG-ID|APPL-11-000015

Vuln-ID|V-230754

APPL-11-000016 - The macOS system must be integrated into a directory services infrastructure.

CAT|I

CCI|CCI-000366

Rule-ID|SV-230755r599842_rule

STIG-ID|APPL-11-000016

Vuln-ID|V-230755

APPL-11-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - maxFailedAttempts

CCI|CCI-002238

Rule-ID|SV-230756r599842_rule

STIG-ID|APPL-11-000022

Vuln-ID|V-230756

APPL-11-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - minutesUntilFailedLoginReset

APPL-11-000023 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.

CCI|CCI-000048

Rule-ID|SV-230757r599842_rule

STIG-ID|APPL-11-000023

Vuln-ID|V-230757

APPL-11-000024 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-230758r599842_rule

STIG-ID|APPL-11-000024

Vuln-ID|V-230758

APPL-11-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-230759r599842_rule

STIG-ID|APPL-11-000025

Vuln-ID|V-230759

APPL-11-000030 - The macOS system must be configured so that log files must not contain access control lists (ACLs).

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-230760r599842_rule

STIG-ID|APPL-11-000030

Vuln-ID|V-230760

APPL-11-000031 - The macOS system must be configured so that log folders must not contain access control lists (ACLs).

Rule-ID|SV-230761r599842_rule

STIG-ID|APPL-11-000031

Vuln-ID|V-230761

APPL-11-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - UserShell

CCI|CCI-002143

Rule-ID|SV-230762r802378_rule

STIG-ID|APPL-11-000032

Vuln-ID|V-230762

APPL-11-000033 - The macOS system must be configured to disable password forwarding for FileVault2.

Rule-ID|SV-230763r599842_rule

STIG-ID|APPL-11-000033

Vuln-ID|V-230763

APPL-11-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

CCI|CCI-001133

Rule-ID|SV-230764r808494_rule

STIG-ID|APPL-11-000051

Vuln-ID|V-230764

APPL-11-000052 - The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.

Rule-ID|SV-230765r808496_rule

STIG-ID|APPL-11-000052

Vuln-ID|V-230765

APPL-11-000053 - The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.

Rule-ID|SV-230766r808498_rule

STIG-ID|APPL-11-000053

Vuln-ID|V-230766

APPL-11-000054 - The macOS system must implement approved ciphers to protect the confidentiality of SSH connections.

CCI|CCI-000087

CCI|CCI-000803

Rule-ID|SV-230767r599842_rule

STIG-ID|APPL-11-000054

Vuln-ID|V-230767

APPL-11-000055 - The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

Rule-ID|SV-230768r599842_rule

STIG-ID|APPL-11-000055

Vuln-ID|V-230768

APPL-11-000056 - The macOS system must implement an approved Key Exchange Algorithm.

Rule-ID|SV-230769r599842_rule

STIG-ID|APPL-11-000056

Vuln-ID|V-230769

APPL-11-001001 - The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all non-local maintenance and diagnostic sessions.

CCI|CCI-000018

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001405

CCI|CCI-002234

CCI|CCI-002884

Rule-ID|SV-230770r599842_rule

STIG-ID|APPL-11-001001

Vuln-ID|V-230770

APPL-11-001002 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.

CCI|CCI-000067

Rule-ID|SV-230771r599842_rule

STIG-ID|APPL-11-001002

Vuln-ID|V-230771

APPL-11-001003 - The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000159

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001889

CCI|CCI-001890

CCI|CCI-001914

CCI|CCI-002130

Rule-ID|SV-230772r599842_rule

STIG-ID|APPL-11-001003

Vuln-ID|V-230772

APPL-11-001010 - The macOS system must shut down by default upon audit failure (unless availability is an overriding concern).

CCI|CCI-000140

Rule-ID|SV-230773r599842_rule

STIG-ID|APPL-11-001010

Vuln-ID|V-230773

APPL-11-001012 - The macOS system must be configured with audit log files owned by root.

Rule-ID|SV-230774r599842_rule

STIG-ID|APPL-11-001012

Vuln-ID|V-230774

APPL-11-001013 - The macOS system must be configured with audit log folders owned by root.

Rule-ID|SV-230775r599842_rule

STIG-ID|APPL-11-001013

Vuln-ID|V-230775

APPL-11-001014 - The macOS system must be configured with audit log files group-owned by wheel.

Rule-ID|SV-230776r599842_rule

Detections

Analytics

DISA STIG Apple macOS 11 v1r6

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Functional Update

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.4 Apr 18, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Apr 12, 2023 Functional Update APPL-11-000053 - The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less. Miscellaneous Metadata updated. Platform check updated. Variables updated.
Revision 1.2 Mar 7, 2023 Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.0 May 17, 2022 Miscellaneous Metadata updated.