DISA STIGS Viewer

The macOS system must enforce FileVault.

Overview

Finding ID Version Rule ID IA Controls Severity
V-268556 APPL-15-005020 SV-268556r1034608_rule   High
Description
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas. Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184
STIG Date
Apple macOS 15 (Sequoia) Security Technical Implementation Guide 2025-05-05

Details

Check Text (C-72586r1034606_chk)
Verify the macOS system is configured to enforce FileVault with the following command:

dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\
.objectForKey('dontAllowFDEDisable').js
EOS
)
fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.")
if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then
echo "1"
else
echo "0"
fi

If the result is not "1", this is a finding.
Fix Text (F-72487r1034607_fix)
Refer to the FileVault supplemental to implement this rule.