STIGQter: STIG Summary: Apple macOS 11 (Big Sur) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The macOS system must be configured to disable sending diagnostic and usage data to Apple.

DISA Rule

SV-230805r599842_rule

Vulnerability Number

V-230805

Group Title

SRG-OS-000096-GPOS-00050

Rule Version

APPL-11-002021

Severity

CAT II

CCI(s)

• CCI-000382 - The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.

Weight

10

Fix Recommendation

This setting is enforced using the "Restrictions Policy" configuration profile.

The setting "Send diagnostic & usage data to Apple" can also be configured in System Preferences >> Security & Privacy >> Privacy >> Analytics & Improvement.

Uncheck the box that says, "Share Mac Analytics".
Uncheck the box that says, "Improve Siri & Dictation".
Uncheck the box that says, "Share with App Developers".

Check Contents

Sending diagnostic and usage data to Apple must be disabled.

To check if a configuration profile is configured to enforce this setting, run the following command:

/usr/bin/sudo /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep allowDiagnosticSubmission

If "allowDiagnosticSubmission" is not set to "0", this is a finding.

Alternately, the setting is found in System Preferences >> Security & Privacy >> Privacy >> Analytics & Improvement.

If the box that says, "Send diagnostic & usage data to Apple" is checked, this is a finding.
If the box that says, "Improve Siri & Dictation" is checked, this is a finding.
If the box that says, "Share with App Developers" is checked, this is a finding.

Vulnerability Number

V-230805

Documentable

False

Rule Version

APPL-11-002021

Severity Override Guidance

Sending diagnostic and usage data to Apple must be disabled.

To check if a configuration profile is configured to enforce this setting, run the following command:

/usr/bin/sudo /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep allowDiagnosticSubmission

If "allowDiagnosticSubmission" is not set to "0", this is a finding.

Alternately, the setting is found in System Preferences >> Security & Privacy >> Privacy >> Analytics & Improvement.

If the box that says, "Send diagnostic & usage data to Apple" is checked, this is a finding.
If the box that says, "Improve Siri & Dictation" is checked, this is a finding.
If the box that says, "Share with App Developers" is checked, this is a finding.

Check Content Reference

M

Target Key

5246

Comments