The macOS system must disable TouchID for unlocking the device.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259517 | APPL-14-002090 | SV-259517r958400_rule | CCI-000056 | medium |
| Description | ||||
| TouchID enables the ability to unlock a macOS system with a user's fingerprint. TouchID must be disabled for "Unlocking your Mac" on all macOS devices that are capable of using TouchID. The system must remain locked until the user establishes access using an authorized identification and authentication method. | ||||
| STIG | Date | |||
| Apple macOS 14 (Sonoma) Security Technical Implementation Guide | 2024-12-04 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-11
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.1.10
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000056
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-259517r958400_chk)
Verify the macOS system is configured to disable TouchID for unlocking the device with the following command:
/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('allowFingerprintForUnlock').js
EOS
If the result is not "false", this is a finding.
Fix Text (F-63164r941172_fix)
Configure the macOS system to disable TouchID for unlocking the device by installing the "com.apple.applicationaccess" configuration profile.