STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.

DISA Rule

SV-274881r1099904_rule

Vulnerability Number

V-274881

Group Title

SRG-OS-000373-GPOS-00156

Rule Version

APPL-15-004022

Severity

CAT II

CCI(s)

• CCI-004895 - Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.

Weight

10

Fix Recommendation

Configure the macOS system to require reauthentication when using "sudo" with the following command:

/usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/timestamp_timeout/d' '{}' \;
/bin/echo "Defaults timestamp_timeout=0" >> /etc/sudoers.d/mscp

Check Contents

Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command:

/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes"

If the result is not "1", this is a finding.

Vulnerability Number

V-274881

Documentable

False

Rule Version

APPL-15-004022

Severity Override Guidance

Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command:

/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes"

If the result is not "1", this is a finding.

Check Content Reference

M

Target Key

5661