STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must ensure System Integrity Protection is enabled.

DISA Rule

SV-268555r1034605_rule

Vulnerability Number

V-268555

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

APPL-15-005001

Severity

CAT I

CCI(s)

CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
CCI-000162 - Protect audit information from unauthorized access.
CCI-000163 - Protect audit information from unauthorized modification.
CCI-000164 - Protect audit information from unauthorized deletion.
CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.
CCI-001493 - Protect audit tools from unauthorized access.
CCI-001494 - Protect audit tools from unauthorized modification.
CCI-001495 - Protect audit tools from unauthorized deletion.
CCI-001499 - Limit privileges to change software resident within software libraries.
CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.
CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.

Weight

Fix Recommendation

Configure the macOS system to enable System Integrity Protection by booting into "Recovery" mode, launching "Terminal" from the "Utilities" menu, and running the following command:

/usr/bin/csrutil enable

Check Contents

Verify the macOS system is configured to enable System Integrity Protection with the following command:

/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.'

If the result is not "1", this is a finding.

Vulnerability Number

V-268555

Documentable

False

Rule Version

APPL-15-005001

Severity Override Guidance

Check Content Reference

Target Key

5661