STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must restrict maximum password lifetime to 60 days.

DISA Rule

SV-268536r1038967_rule

Vulnerability Number

V-268536

Group Title

SRG-OS-000076-GPOS-00044

Rule Version

APPL-15-003008

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

Configure the macOS system to restrict maximum password lifetime to 60 days by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.

Check Contents

Verify the macOS system is configured to restrict maximum password lifetime to 60 days with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' -

If the result is not "60" or less, this is a finding.

Vulnerability Number

V-268536

Documentable

False

Rule Version

APPL-15-003008

Severity Override Guidance

Verify the macOS system is configured to restrict maximum password lifetime to 60 days with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' -

If the result is not "60" or less, this is a finding.

Check Content Reference

M

Target Key

5661