2.4.10 Ensure Content Caching Is Disabled


Starting with 10.13 (macOS High Sierra), Apple introduced a service to make it easier to deploy data from Apple, including software updates, where there are bandwidth constraints to the Internet and fewer constraints or greater bandwidth exist on the local subnet. This capability can be very valuable for organizations that have throttled and possibly metered Internet connections. In heterogeneous enterprise networks with multiple subnets, the effectiveness of this capability would be determined by how many Macs were on each subnet at the time new, large updates were made available upstream. This capability requires the use of mac OS clients as P2P nodes for updated Apple content. Unless there is a business requirement to manage operational Internet connectivity and bandwidth user endpoints should not store content and act as a cluster to provision data.

Content types supported by Content Caching in macOS


The main use case for Mac computers is as mobile user endpoints. P2P sharing services should not be enabled on laptops that are using untrusted networks. Content Caching can allow a computer to be a server for local nodes on an untrusted network. While there are certainly logical controls that could be used to mitigate risk, they add to the management complexity. Since the value of the service is in specific use cases organizations with the use case described above can accept risk as necessary.


This setting will adversely affect bandwidth usage between local subnets and the Internet.


Perform the following to disable Content Caching:
Graphical Method:

Open System Preferences

Select Sharing

Uncheck Content Caching

Terminal Method:
Run the following command to disable Content Caching:

$ sudo /usr/bin/AssetCacheManagerUtil deactivate

The output will include Content caching deactivated
Profile Method:

Create or edit a configuration profile with the PayLoadType of com.apple.applicationaccess

Add the key allowContentCaching

Set the key to </false>

See Also


Item Details


References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 335da4af5d2eb7953418af34b5c63e33bfbab9f762cf3ec1b98ef9b5fa5f9703