STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must set minimum password lifetime to 24 hours.

DISA Rule

SV-268548r1131244_rule

Vulnerability Number

V-268548

Group Title

SRG-OS-000075-GPOS-00043

Rule Version

APPL-15-003070

Severity

CAT II

CCI(s)

CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

Fix Recommendation

Configure the macOS system to set minimum password lifetime to 24 hours.

This setting may be enforced using local policy.

To set local policy to require a minimum password lifetime, edit the current password policy to contain the following <dict> within the "policyCategoryPasswordContent":

[source,xml]
----
<dict>
<key>policyContent</key>
<string>policyAttributeLastPasswordChangeTime < policyAttributeCurrentTime - (policyAttributeMinimumLifetimeHours * 60 * 60)</string>
<key>policyIdentifier</key>
<string>Minimum Password Lifetime</string>
<key>policyParameters</key>
<dict>
<key>policyAttributeMinimumLifetimeHours</key>
<integer>24</integer>
</dict>
</dict>
----
After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".

[source,bash]
----
/usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
----

Check Contents

Verify the macOS system is configured to set minimum password lifetime to 24 hours with the following command:

/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "yes"} else {print "no"}}'

If the result is not "yes", this is a finding.

Vulnerability Number

V-268548

Documentable

False

Rule Version

APPL-15-003070

Severity Override Guidance

Check Content Reference

Target Key

5661