Check: APPL-14-005020
Apple macOS 14 (Sonoma) STIG:
APPL-14-005020
(in versions v1 r2 through v1 r1)
Title
The macOS system must enforce FileVault. (Cat I impact)
Discussion
FileVault must be enforced. The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas. Satisfies: SRG-OS-000185-GPOS-00079,SRG-OS-000404-GPOS-00183,SRG-OS-000405-GPOS-00184
Check Content
Verify the macOS system is configured to enforce FileVault with the following command: dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable').js EOS ) fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then echo "1" else echo "0" fi If the result is not "1", this is a finding.
Fix Text
Note: Refer to the FileVault supplemental to implement this rule.
Additional Identifiers
Rule ID: SV-259561r941305_rule
Vulnerability ID: V-259561
Group Title: SRG-OS-000185-GPOS-00079
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001199 |
The information system protects the confidentiality and/or integrity of organization-defined information at rest. |
| CCI-002475 |
The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components. |
| CCI-002476 |
The information system implements cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined information system components. |