DISA STIGS Viewer

The macOS system must ensure Secure Boot level is set to "full".

Overview

Finding ID Version Rule ID IA Controls Severity
V-268568 APPL-15-005100 SV-268568r1034644_rule   Medium
Description
The Secure Boot security setting must be set to "full". Full security is the default Secure Boot setting in macOS. During startup, when Secure Boot is set to full security, the Mac will verify the integrity of the operating system before allowing the operating system to boot. NOTE: This will only return a proper result on a T2 or Apple Silicon Macs. Satisfies: SRG-OS-000445-GPOS-00199, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201
STIG Date
Apple macOS 15 (Sequoia) Security Technical Implementation Guide 2025-05-05

Details

Check Text (C-72598r1034642_chk)
Verify the macOS system is configured to ensure Secure Boot level is set to "full" using the following command:

/usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "SecureBootLevel = full"

If the result is not "1", this is a finding.
Fix Text (F-72499r1034643_fix)
Configure the macOS system to ensure Secure Boot level is set to "full" by booting into Recovery Mode and enabling Full Secure Boot.