DISA STIGS Viewer

The macOS system must disable TouchID for unlocking the device.

Overview

Finding ID Version Rule ID IA Controls Severity
V-268516 APPL-15-002090 SV-268516r1034488_rule   Medium
Description
TouchID enables the ability to unlock a Mac system with a user's fingerprint. TouchID must be disabled for "Unlocking your Mac" on all macOS devices that are capable of using TouchID. The system must remain locked until the user establishes access using an authorized identification and authentication method. NOTE: TouchID is not an approved biometric authenticator for U.S. Federal Government use as it has not been verified to meet the strength requirements outlined in NIST SP 800-63.
STIG Date
Apple macOS 15 (Sequoia) Security Technical Implementation Guide 2025-05-05

Details

Check Text (C-72546r1034486_chk)
Verify the macOS system is configured to disable TouchID for unlocking the device with the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('allowFingerprintForUnlock').js
EOS

If the result is not "false", this is a finding.
Fix Text (F-72447r1034487_fix)
Configure the macOS system to disable TouchID for unlocking the device by installing the "com.apple.applicationaccess" configuration profile.