STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must be configured to shut down upon audit failure.

DISA Rule

SV-268455r1038966_rule

Vulnerability Number

V-268455

Group Title

SRG-OS-000047-GPOS-00023

Rule Version

APPL-15-001010

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

Configure the macOS system to shut down upon audit failure with the following command:

/usr/bin/sed -i.bak 's/^policy.*/policy: ahlt,argv/' /etc/security/audit_control; /usr/sbin/audit -s

Check Contents

Verify the macOS system is configured to shut down upon audit failure with the following command:

/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt'

If the result is not "1", this is a finding.

Vulnerability Number

V-268455

Documentable

False

Rule Version

APPL-15-001010

Severity Override Guidance

Verify the macOS system is configured to shut down upon audit failure with the following command:

/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt'

If the result is not "1", this is a finding.

Check Content Reference

M

Target Key

5661