2.5.2 Ensure Listen for 'Hey Siri' Is Disabled


macOS includes the Siri digital assistant and if enabled it is always listening in case it is needed. In Sonoma a user may choose either 'Hey Siri' or either 'Siri' and 'Hey Siri', in either case Siri is using the microphone at all times to listen for instructions and then can record questions once activated. In an organizational environment where people are talking and listening on video/voice calls there are too many opportunities for unauthorized information disclosure to have a live microphone at all times. If Siri will be used it may be on, with 'Listen for' Off and a keyboard shortcut selected.


In most environments there is too much unbounded risk of data spillage with a microphone always on listening for instruction and if attention is obtained listening for questions, relying on cloud compute to answer them. There are many examples of data leakage for technology in this space, future vulnerabilities and bugs are certainly possible.


Siri will not be available for hands free usage, or not available at all if turned off completely.


Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.Siri

The key to include is set to

The key must be set to <false/>

Note: After testing, this profile will disable Hey Siribut only for the first input but not additional inputs. It cannot be assumed that there will only be one input, so setting this recommendation is advised but cannot fully be assessed. For the time being this recommendation is currently not automated, but will be in future releases if we can properly configure this recommendation.

See Also