APPL-12-000001 - The macOS system must be configured to prevent Apple Watch from terminating a session lock.

CAT|II

CCI|CCI-000056

Rule-ID|SV-252436r816122_rule

STIG-ID|APPL-12-000001

Vuln-ID|V-252436

APPL-12-000002 - The macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.

Rule-ID|SV-252437r816125_rule

STIG-ID|APPL-12-000002

Vuln-ID|V-252437

APPL-12-000003 - The macOS system must initiate the session lock no more than five seconds after a screen saver is started.

Rule-ID|SV-252438r816128_rule

STIG-ID|APPL-12-000003

Vuln-ID|V-252438

APPL-12-000004 - The macOS system must initiate a session lock after a 15-minute period of inactivity.

CCI|CCI-000057

Rule-ID|SV-252439r816131_rule

STIG-ID|APPL-12-000004

Vuln-ID|V-252439

APPL-12-000005 - The macOS system must be configured to lock the user session when a smart token is removed.

CCI|CCI-000058

Rule-ID|SV-252440r816134_rule

STIG-ID|APPL-12-000005

Vuln-ID|V-252440

APPL-12-000006 - The macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

CAT|III

CCI|CCI-000060

Rule-ID|SV-252441r816137_rule

STIG-ID|APPL-12-000006

Vuln-ID|V-252441

APPL-12-000007 - The macOS system must be configured to disable hot corners - bottom left

Rule-ID|SV-252442r816140_rule

STIG-ID|APPL-12-000007

Vuln-ID|V-252442

APPL-12-000007 - The macOS system must be configured to disable hot corners - bottom right

APPL-12-000007 - The macOS system must be configured to disable hot corners - top left

APPL-12-000007 - The macOS system must be configured to disable hot corners - top right

APPL-12-000011 - The macOS system must disable the SSHD service.

CCI|CCI-000068

CCI|CCI-001453

CCI|CCI-001941

CCI|CCI-001942

CCI|CCI-001967

CCI|CCI-002418

CCI|CCI-002420

CCI|CCI-002421

CCI|CCI-002422

CCI|CCI-002890

CCI|CCI-003123

Rule-ID|SV-252443r853258_rule

STIG-ID|APPL-12-000011

Vuln-ID|V-252443

APPL-12-000012 - The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

CCI|CCI-000016

CCI|CCI-001682

Rule-ID|SV-252444r816146_rule

STIG-ID|APPL-12-000012

Vuln-ID|V-252444

APPL-12-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time On

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-252445r853259_rule

STIG-ID|APPL-12-000014

Vuln-ID|V-252445

APPL-12-000014 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS) - Network Time Server

APPL-12-000015 - The macOS system must utilize an ESS solution and implement all DoD required modules - ESS and implement all DoD required modules.

CCI|CCI-001233

Rule-ID|SV-252446r816152_rule

STIG-ID|APPL-12-000015

Vuln-ID|V-252446

APPL-12-000016 - The macOS system must be integrated into a directory services infrastructure.

CAT|I

CCI|CCI-000366

Rule-ID|SV-252447r816155_rule

STIG-ID|APPL-12-000016

Vuln-ID|V-252447

APPL-12-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - maxFailedAttempts

CCI|CCI-002238

Rule-ID|SV-252448r853260_rule

STIG-ID|APPL-12-000022

Vuln-ID|V-252448

APPL-12-000022 - The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked - minutesUntilFailedLoginReset

APPL-12-000023 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.

CCI|CCI-000048

Rule-ID|SV-252449r816161_rule

STIG-ID|APPL-12-000023

Vuln-ID|V-252449

APPL-12-000024 - The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

CCI|CCI-000050

Rule-ID|SV-252450r858503_rule

STIG-ID|APPL-12-000024

Vuln-ID|V-252450

APPL-12-000025 - The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system.

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-252451r816167_rule

STIG-ID|APPL-12-000025

Vuln-ID|V-252451

APPL-12-000030 - The macOS system must be configured so that log files must not contain access control lists (ACLs).

CCI|CCI-000162

CCI|CCI-001314

Rule-ID|SV-252452r816170_rule

STIG-ID|APPL-12-000030

Vuln-ID|V-252452

APPL-12-000031 - The macOS system must be configured so that log folders must not contain access control lists (ACLs).

Rule-ID|SV-252453r816173_rule

STIG-ID|APPL-12-000031

Vuln-ID|V-252453

APPL-12-000032 - The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup - UserShell

CCI|CCI-002143

Rule-ID|SV-252454r853262_rule

STIG-ID|APPL-12-000032

Vuln-ID|V-252454

APPL-12-000033 - The macOS system must be configured to disable password forwarding for FileVault2.

Rule-ID|SV-252455r853263_rule

STIG-ID|APPL-12-000033

Vuln-ID|V-252455

APPL-12-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

CCI|CCI-001133

Rule-ID|SV-252456r858505_rule

STIG-ID|APPL-12-000051

Vuln-ID|V-252456

APPL-12-000052 - The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.

Rule-ID|SV-252457r858507_rule

STIG-ID|APPL-12-000052

Vuln-ID|V-252457

APPL-12-000053 - The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.

Rule-ID|SV-252458r858509_rule

STIG-ID|APPL-12-000053

Vuln-ID|V-252458

APPL-12-000054 - The macOS system must implement approved ciphers to protect the confidentiality of SSH connections.

CCI|CCI-000803

Rule-ID|SV-252459r860808_rule

STIG-ID|APPL-12-000054

Vuln-ID|V-252459

APPL-12-000055 - The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

Rule-ID|SV-252460r860810_rule

STIG-ID|APPL-12-000055

Vuln-ID|V-252460

APPL-12-000056 - The macOS system must implement an approved Key Exchange Algorithm.

Rule-ID|SV-252461r860812_rule

STIG-ID|APPL-12-000056

Vuln-ID|V-252461

APPL-12-001001 - The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all non-local maintenance and diagnostic sessions.

CCI|CCI-000018

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001405

CCI|CCI-002234

CCI|CCI-002884

Rule-ID|SV-252462r853271_rule

STIG-ID|APPL-12-001001

Vuln-ID|V-252462

APPL-12-001002 - The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.

CCI|CCI-000067

Rule-ID|SV-252463r816463_rule

STIG-ID|APPL-12-001002

Vuln-ID|V-252463

APPL-12-001003 - The macOS system must initiate session audits at system startup

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000159

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001889

CCI|CCI-001890

CCI|CCI-001914

CCI|CCI-002130

Rule-ID|SV-252464r853272_rule

STIG-ID|APPL-12-001003

Vuln-ID|V-252464

APPL-12-001010 - The macOS system must shut down by default upon audit failure (unless availability is an overriding concern).

CCI|CCI-000140

Rule-ID|SV-252465r816466_rule

STIG-ID|APPL-12-001010

Vuln-ID|V-252465

APPL-12-001012 - The macOS system must be configured with audit log files owned by root.

Rule-ID|SV-252466r816212_rule

STIG-ID|APPL-12-001012

Vuln-ID|V-252466

APPL-12-001013 - The macOS system must be configured with audit log folders owned by root.

Rule-ID|SV-252467r816215_rule

STIG-ID|APPL-12-001013

Vuln-ID|V-252467

APPL-12-001014 - The macOS system must be configured with audit log files group-owned by wheel.

Rule-ID|SV-252468r816218_rule

STIG-ID|APPL-12-001014

Vuln-ID|V-252468

APPL-12-001015 - The macOS system must be configured with audit log folders group-owned by wheel.

Rule-ID|SV-252469r816221_rule

STIG-ID|APPL-12-001015

Vuln-ID|V-252469

APPL-12-001016 - The macOS system must be configured with audit log files set to mode 440 or less permissive.

Detections

Analytics

DISA STIG Apple macOS 12 v1r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.4 Apr 18, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Variables updated.
Revision 1.2 Mar 7, 2023 Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Metadata updated.