STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must configure sudo to log events.

DISA Rule

SV-268451r1131208_rule

Vulnerability Number

V-268451

Group Title

SRG-OS-000064-GPOS-00033

Rule Version

APPL-15-000190

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Configure the macOS system to log privilege escalation with the following command:

/usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/^Defaults[[:blank:]]*\!log_allowed/s/^/# /' '{}' \;
/bin/echo "Defaults log_allowed" >> /etc/sudoers.d/mscp

Check Contents

Verify the macOS system is configured to log privilege escalation with the following command:

/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers"

If the result is not "1", this is a finding.

Vulnerability Number

V-268451

Documentable

False

Rule Version

APPL-15-000190

Severity Override Guidance

Verify the macOS system is configured to log privilege escalation with the following command:

/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers"

If the result is not "1", this is a finding.

Check Content Reference

M

Target Key

5661