← Back to Apple macOS 14 (Sonoma) Security Technical Implementation Guide

V-259517

CAT II (Medium)

The macOS system must disable TouchID for unlocking the device.

Rule ID

SV-259517r958400_rule

STIG

Apple macOS 14 (Sonoma) Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000056

Discussion

TouchID enables the ability to unlock a macOS system with a user's fingerprint. TouchID must be disabled for "Unlocking your Mac" on all macOS devices that are capable of using TouchID. The system must remain locked until the user establishes access using an authorized identification and authentication method.

Check Content

Verify the macOS system is configured to disable TouchID for unlocking the device with the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('allowFingerprintForUnlock').js
EOS

If the result is not "false", this is a finding.

Fix Text

Configure the macOS system to disable TouchID for unlocking the device by installing the "com.apple.applicationaccess" configuration profile.