Detections
Analytics
APPL-15-002090 - The macOS system must disable TouchID for unlocking the device.
Information
TouchID enables the ability to unlock a Mac system with a user's fingerprint.TouchID must be disabled for "Unlocking your Mac" on all macOS devices that are capable of using TouchID.
The system must remain locked until the user establishes access using an authorized identification and authentication method.
NOTE: TouchID is not an approved biometric authenticator for U.S. Federal Government use as it has not been verified to meet the strength requirements outlined in NIST SP 800-63.
Solution
Configure the macOS system to disable TouchID for unlocking the device by installing the "com.apple.applicationaccess" configuration profile.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_15_V1R7_STIG.zip
Item Details
Audit Name: DISA Apple macOS 15 Sequoia STIG v1r7
Category: ACCESS CONTROL
References: 800-53|AC-11b., CAT|II, CCI|CCI-000056, Rule-ID|SV-268516r1034488_rule, STIG-ID|APPL-15-002090, Vuln-ID|V-268516
Plugin: Unix
Control ID: cce020f2b70ebfa36203254361fb807fc40c1aec707b4b2acfada81c4923091b