Home
Security Hardening
DISA STIG Apple Mac OSX 10 15 V1R7

DISA STIG Apple Mac OSX 10 15 V1R7

AOSX-15-000032 – The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup – FileVault User
Details When ‘FileVault’ and Multifactor Authentication are configured on the operating system, a dedicated user must be configured to ensure...
AOSX-15-000032 – The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup – UserShell
Details When ‘FileVault’ and Multifactor Authentication are configured on the operating system, a dedicated user must be configured to ensure...
AOSX-15-000051 – The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.
Details SSH should be configured to log users out after a 15-minute interval of inactivity and to wait only 30...
AOSX-15-001029 – The macOS system must allocate audit record storage capacity to store at least one week’s worth of audit records when audit records are not immediately sent to a central audit record storage facility.
Details The audit service must be configured to require that records are kept for seven days or longer before deletion...
AOSX-15-001030 – The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.
Details The audit service must be configured to require a minimum percentage of free disk space in order to run....
AOSX-15-001031 – The macOS system must provide an immediate real-time alert to the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.
Details The audit service should be configured to immediately print messages to the console or email administrator users when an...
AOSX-15-001015 – The macOS system must be configured with audit log folders group-owned by wheel.
Details The audit service must be configured to create log files with the correct group ownership to prevent normal users...
AOSX-15-001016 – The macOS system must be configured with audit log files set to mode 440 or less permissive.
Details The audit service must be configured to create log files with the correct permissions to prevent normal users from...
AOSX-15-001017 – The macOS system must be configured with audit log folders set to mode 700 or less permissive.
Details The audit service must be configured to create log folders with the correct permissions to prevent normal users from...
AOSX-15-001020 – The macOS system must audit the enforcement actions used to restrict access associated with changes to the system.
Details By auditing access restriction enforcement, changes to application and OS configuration files can be audited. Without auditing the enforcement...

DISA STIG Apple Mac OSX 10 15 V1R7

AOSX-15-000032 – The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup – FileVault User

AOSX-15-000032 – The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup – UserShell

AOSX-15-000051 – The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

AOSX-15-001029 – The macOS system must allocate audit record storage capacity to store at least one week’s worth of audit records when audit records are not immediately sent to a central audit record storage facility.

AOSX-15-001030 – The macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.

AOSX-15-001031 – The macOS system must provide an immediate real-time alert to the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

AOSX-15-001015 – The macOS system must be configured with audit log folders group-owned by wheel.

AOSX-15-001016 – The macOS system must be configured with audit log files set to mode 440 or less permissive.

AOSX-15-001017 – The macOS system must be configured with audit log folders set to mode 700 or less permissive.

AOSX-15-001020 – The macOS system must audit the enforcement actions used to restrict access associated with changes to the system.