CIS Apple macOS 15.0 Sequoia Benchmark

This recommendation verifies that All Apple-Provided Software Is Current on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to all Apple-Provided Software Is Current may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

softwareupdate -l
# Should return "No new software available."

softwareupdate --install --all --restart

This setting controls whether Automatic Software Update is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Automatic Software Update enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled
# Should be: 1

defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true

This setting controls whether Automatic Download of Updates is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Automatic Download of Updates enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload
# Should be: 1

defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true

This setting controls whether Install of macOS Updates is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Install of macOS Updates enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates
# Should be: 1

defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true

This recommendation verifies that Bluetooth Is Disabled If Not Needed on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to bluetooth Is Disabled If Not Needed may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read /Library/Preferences/com.apple.Bluetooth ControllerPowerState
# Should be: 0 (if no Bluetooth peripherals are in use)

defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0
killall -HUP bluetoothd

This setting controls whether AirDrop is disabled on the macOS Sequoia operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving AirDrop enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the macOS Sequoia operating system.

defaults read com.apple.NetworkBrowser DisableAirDrop
# Should be: 1

defaults write com.apple.NetworkBrowser DisableAirDrop -bool true

This setting controls whether Bluetooth Sharing is disabled on the macOS Sequoia operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Bluetooth Sharing enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the macOS Sequoia operating system.

# Check via System Settings > General > Sharing > Bluetooth Sharing
# Or via MDM profile payload

Disable Bluetooth Sharing in System Settings > General > Sharing, or enforce via MDM configuration profile.

This recommendation verifies that Date and Time Are Set Automatically on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to date and Time Are Set Automatically may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemsetup -getusingnetworktime
# Should be: Network Time is on

systemsetup -setusingnetworktime on

This recommendation configures Time to an Authorized NTP Server on the macOS Sequoia operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for Time could weaken security controls or allow unintended behavior. Setting this to an Authorized NTP Server ensures the macOS Sequoia operating system operates within a well-defined security boundary.

systemsetup -getnetworktimeserver
# Should point to an organizational NTP server

systemsetup -setnetworktimeserver time.apple.com

This setting controls whether Security Auditing is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Security Auditing enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

launchctl list | grep com.apple.auditd
# Should return a result

launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist

This recommendation addresses the proper configuration of Audit Log Retention on the macOS Sequoia operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Audit Log Retention can lead to security gaps that may be exploited by attackers. A properly configured macOS Sequoia operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E 'expire-after' /etc/security/audit_control
# Should be set (e.g., expire-after:60d)

# /etc/security/audit_control:
expire-after:60d OR 1G

This recommendation verifies that install.log Is Retained for 365 Days on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to install.log Is Retained for 365 Days may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i ttl /etc/asl/com.apple.install
# Should be ttl=365

# /etc/asl/com.apple.install:
# Set ttl=365 for install log retention

This setting controls whether Firewall Logging is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Firewall Logging enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmode
# Should be: enabled

/usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on

This recommendation verifies that Firewall Logging Detail Is Set on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to firewall Logging Detail Is Set may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingopt
# Should be: detail

/usr/libexec/ApplicationFirewall/socketfilterfw --setloggingopt detail

This setting controls whether Firewall is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Firewall enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
# Should be: enabled

/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

This setting controls whether Firewall Stealth Mode is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Firewall Stealth Mode enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
# Should be: enabled

/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

This recommendation verifies that Signed Applications Are Automatically Allowed on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to signed Applications Are Automatically Allowed may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

/usr/libexec/ApplicationFirewall/socketfilterfw --getallowsigned
# Should be: enabled

/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on

This recommendation verifies that Location Services Are Authorized on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to location Services Are Authorized may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check System Settings > Privacy & Security > Location Services
# Review authorized applications for business need

Disable location services for applications that do not have a business need via System Settings or MDM profile.

This setting controls whether Internet Sharing is disabled on the macOS Sequoia operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Internet Sharing enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the macOS Sequoia operating system.

defaults read /Library/Preferences/SystemConfiguration/com.apple.nat NAT 2>/dev/null | grep -c Enabled
# Should be: 0 or key not found

Disable Internet Sharing in System Settings > General > Sharing.

This recommendation verifies that Remote Login (SSH) Is Disabled If Not Needed on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to remote Login (SSH) Is Disabled If Not Needed may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemsetup -getremotelogin
# Should be: Remote Login: Off

systemsetup -setremotelogin off

This setting controls whether FileVault is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without FileVault enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

fdesetup status
# Should be: FileVault is On.

fdesetup enable
# Follow prompts to set recovery key

This recommendation verifies that FileVault Recovery Key Is Escrowed on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to fileVault Recovery Key Is Escrowed may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify recovery key is stored in MDM or institutional key escrow
profiles -C -o stdout | grep -c FDERecoveryKeyEscrow

Configure MDM to escrow FileVault recovery keys automatically using the FDERecoveryKeyEscrow payload.

This recommendation configures the timeout for Screen Saver on the macOS Sequoia operating system. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to screen Saver Timeout Is 20 Minutes or Less may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults -currentHost read com.apple.screensaver idleTime
# Should be 1200 or less

defaults -currentHost write com.apple.screensaver idleTime -int 1200

This recommendation verifies that Screen Lock on Screen Saver Is Immediate on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to screen Lock on Screen Saver Is Immediate may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysadminctl -screenLock status
# Should show immediate lock requirement

sysadminctl -screenLock immediate -password -

This recommendation verifies that Login Window Displays Name and Password Fields on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to login Window Displays Name and Password Fields may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read /Library/Preferences/com.apple.loginwindow SHOWFULLNAME
# Should be: 1

defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool true

This setting controls whether Guest Account is disabled on the macOS Sequoia operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Guest Account enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the macOS Sequoia operating system.

defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled
# Should be: 0

defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false

This recommendation verifies that a Password Policy is present on the macOS Sequoia operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of a Password Policy leaves the macOS Sequoia operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

pwpolicy -getaccountpolicies 2>/dev/null | xmllint --xpath '//dict' -
# Review password policy settings

Deploy a password policy via MDM configuration profile with minimum length, complexity, and history requirements.

This recommendation addresses the proper configuration of Account Lockout Threshold on the macOS Sequoia operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Account Lockout Threshold can lead to security gaps that may be exploited by attackers. A properly configured macOS Sequoia operating system reduces exposure to both known vulnerabilities and configuration drift.

pwpolicy -getaccountpolicies 2>/dev/null | grep maxFailedLoginAttempts

Set maximum failed login attempts to 5 via MDM profile. Configure policyAttributeMaximumFailedAuthentications in the passcode payload.

This setting controls whether System Integrity Protection (SIP) is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without System Integrity Protection (SIP) enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

csrutil status
# Should be: System Integrity Protection status: enabled.

# Boot into Recovery Mode (Cmd+R at startup), then:
csrutil enable

This setting controls whether Sealed System Volume (SSV) is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Sealed System Volume (SSV) enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

csrutil authenticated-root status
# Should be: enabled

# Boot into Recovery Mode:
csrutil authenticated-root enable

This setting controls whether Firmware Password / Startup Security is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Firmware Password / Startup Security enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# Apple Silicon: Startup Security Utility in Recovery Mode
# Intel: firmwarepasswd -check

Apple Silicon: Boot to Recovery, open Startup Security Utility, set "Full Security". Intel: Boot to Recovery and use firmwarepasswd -setpasswd.

This setting controls whether Gatekeeper is enabled on the macOS Sequoia operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via System Settings, MDM profiles, or command-line configuration.

Without Gatekeeper enabled, the macOS Sequoia operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

spctl --status
# Should be: assessments enabled

spctl --master-enable

This recommendation verifies that Allow Applications from App Store and Identified Developers on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to allow Applications from App Store and Identified Developers may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

spctl --status --verbose
# Review allowed sources

In System Settings > Privacy & Security, set "Allow applications downloaded from" to "App Store and identified developers".

This recommendation verifies that Safari Downloads Are Validated on the macOS Sequoia operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to safari Downloads Are Validated may leave the macOS Sequoia operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

defaults read com.apple.Safari AutoOpenSafeDownloads
# Should be: 0

defaults write com.apple.Safari AutoOpenSafeDownloads -bool false