STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must configure user session lock when a smart token is removed.

DISA Rule

SV-268423r1034209_rule

Vulnerability Number

V-268423

Group Title

SRG-OS-000030-GPOS-00011

Rule Version

APPL-15-000005

Severity

CAT II

CCI(s)

• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure the macOS system to lock the user session when a smart token is removed by installing the "com.apple.security.smartcard" configuration profile.

NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.

Check Contents

Verify the macOS system is configured to lock the user session when a smart token is removed with the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
.objectForKey('tokenRemovalAction').js
EOS

If the result is not "1", this is a finding.

Vulnerability Number

V-268423

Documentable

False

Rule Version

APPL-15-000005

Severity Override Guidance

Verify the macOS system is configured to lock the user session when a smart token is removed with the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
.objectForKey('tokenRemovalAction').js
EOS

If the result is not "1", this is a finding.

Check Content Reference

M

Target Key

5661