Detections
Analytics

1.153 APPL-14-005110

Information

The macOS system must enforce enrollment in mobile device management.

GROUP ID: V-259574RULE ID: SV-259574r991589

Users must enroll their Mac in a Mobile Device Management (MDM) software.

User Approved MDM (UAMDM) enrollment or enrollment via Apple Business Manager (ABM)/Apple School Manager (ASM) is required to manage certain security settings. Currently these include:

 - Allowed Kernel Extensions
 - Allowed Approved System Extensions
 - Privacy Preferences Policy Control Payload
 - ExtensibleSingleSignOn
 - FDEFileVault

In macOS 11, UAMDM grants Supervised status on a Mac, unlocking the following MDM features, which were previously locked behind ABM:

 - Activation Lock Bypass
 - Access to Bootstrap Tokens
 - Scheduling Software Updates
 - Query list and delete local users

Solution

Configure the macOS system by ensuring that system is enrolled via UAMDM.

See Also

https://workbench.cisecurity.org/benchmarks/24070

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-259574r991589_rule, STIG-ID|APPL-14-005110, Vuln-ID|V-259574

Plugin: Unix

Control ID: d70649fdaffacea1f134844481e416e5f1649cb735aa09c8a39fd2e4c3adc38f