STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must set smart card certificate trust to moderate.

DISA Rule

SV-268471r1034353_rule

Vulnerability Number

V-268471

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

APPL-15-001060

Severity

CAT II

CCI(s)

CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

Fix Recommendation

Configure the macOS system to check the revocation status of user certificates by installing the "com.apple.security.smartcard" configuration profile.

NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.

Check Contents

Verify the macOS system is configured to check the revocation status of user certificates with the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
.objectForKey('checkCertificateTrust').js
EOS

If the result is not "2", this is a finding.

Vulnerability Number

V-268471

Documentable

False

Rule Version

APPL-15-001060

Severity Override Guidance

Check Content Reference

Target Key

5661