STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character.

DISA Rule

SV-268547r1034581_rule

Vulnerability Number

V-268547

Group Title

SRG-OS-000069-GPOS-00037

Rule Version

APPL-15-003060

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.
• CCI-004065 - For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.

Weight

10

Fix Recommendation

Configure the macOS system to require at least one lowercase character and one uppercase character in password complexity by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.

Check Contents

Verify the macOS system is configured to require that passwords contain a minimum of one lowercase character and one uppercase character with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).*$'\''")])' -

If the result is not "true", this is a finding.

Vulnerability Number

V-268547

Documentable

False

Rule Version

APPL-15-003060

Severity Override Guidance

Verify the macOS system is configured to require that passwords contain a minimum of one lowercase character and one uppercase character with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).*$'\''")])' -

If the result is not "true", this is a finding.

Check Content Reference

M

Target Key

5661