STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must set account lockout time to 15 minutes.

DISA Rule

SV-268440r1131197_rule

Vulnerability Number

V-268440

Group Title

SRG-OS-000021-GPOS-00005

Rule Version

APPL-15-000060

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
• CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Weight

10

Fix Recommendation

Configure the macOS system to set account lockout time to 15 minutes by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.

Check Contents

Verify the macOS system is configured to set account lockout time to 15 minutes with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "yes"} else {print "no"}}' | /usr/bin/uniq

If the result is not "yes", this is a finding.

Vulnerability Number

V-268440

Documentable

False

Rule Version

APPL-15-000060

Severity Override Guidance

Verify the macOS system is configured to set account lockout time to 15 minutes with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "yes"} else {print "no"}}' | /usr/bin/uniq

If the result is not "yes", this is a finding.

Check Content Reference

M

Target Key

5661