Skip to content
ATO Pathways
  Log In

Apple macOS 15 (Sequoia) Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000068-GPOS-00036

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must allow smart card authentication.

    &lt;VulnDiscussion&gt;Smart card authentication must be allowed. The use of smart card credentials facilitates standardization and reduces the ris...
    Rule Medium Severity
    Show

  • SRG-OS-000105-GPOS-00052

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must enforce multifactor authentication for login.

    &lt;VulnDiscussion&gt;The system must be configured to enforce multifactor authentication. All users must go through multifactor authentication to...
    Rule Medium Severity
    Show

  • SRG-OS-000105-GPOS-00052

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must enforce multifactor authentication for the su command.

    &lt;VulnDiscussion&gt;The system must be configured such that, when the su command is used, multifactor authentication is enforced. All users must...
    Rule Medium Severity
    Show

  • SRG-OS-000105-GPOS-00052

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.

    &lt;VulnDiscussion&gt;The system must be configured to enforce multifactor authentication when the sudo command is used to elevate privilege. All ...
    Rule Medium Severity
    Show

  • SRG-OS-000069-GPOS-00037

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character.

    &lt;VulnDiscussion&gt;The macOS must be configured to require that at least one lowercase character and one uppercase character be used when a pass...
    Rule Medium Severity
    Show

  • SRG-OS-000075-GPOS-00043

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must set minimum password lifetime to 24 hours.

    &lt;VulnDiscussion&gt;The macOS must be configured to enforce a minimum password lifetime limit of 24 hours. This rule discourages users from cycl...
    Rule Medium Severity
    Show

  • SRG-OS-000118-GPOS-00060

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must disable accounts after 35 days of inactivity.

    &lt;VulnDiscussion&gt;The macOS must be configured to disable accounts after 35 days of inactivity. This rule prevents malicious users from employ...
    Rule Medium Severity
    Show

  • SRG-OS-000205-GPOS-00083

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.

    &lt;VulnDiscussion&gt;The Apple System Logs must be owned by root. ASLs contain sensitive data about the system and users. Setting ASL files to be...
    Rule Medium Severity
    Show

  • SRG-OS-000205-GPOS-00083

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must configure Apple System Log (ASL) files to mode 640 or less permissive.

    &lt;VulnDiscussion&gt;The Apple System Logs must be configured to be writable by root and readable only by the root user and group wheel. To achiev...
    Rule Medium Severity
    Show

  • SRG-OS-000205-GPOS-00083

    <GroupDescription></GroupDescription>
    Group
    Show

  • The macOS system must configure system log files owned by root and group to wheel.

    &lt;VulnDiscussion&gt;The system log files must be owned by root. System logs contain sensitive data about the system and users. Setting log files...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules