Juan Fernandez
e83c2689f5
Resolves #45644 Bring the macOS CIS benchmark policies up to the current CIS releases: - macOS 14 Sonoma: v3.0.0 -> v3.1.0 - macOS 15 Sequoia: v2.0.0 -> v2.1.0 - macOS 26 Tahoe: v1.0.0 -> v1.1.0 Policy changes: - 2.7.1: rescope the screen saver hot corners check to the current console user and move it to Level 1, per the updated CIS audit. - 3.4: relax audit log retention to >= 30 days (no size requirement); parse the day value anchored to `expire-after:` so a mixed directive such as `7d OR 30d` is correctly rejected. - 5.1.7: exclude the non-accessible /Library/AppStore directory and its descendants from the world-writable Library check. - 5.6: update for the new secure-token audit (verify root has no AuthenticationAuthority). - 5.3.1: add the internal APFS volume encryption check (Manual -> Automated) on macOS 26; remove the deprecated CoreStorage 5.3.2 check on macOS 14/15. - 2.10.1: correct the screen saver inactivity threshold to <= 900s (15 minutes) to match the CIS audit. Limitations documented (no reliable fleetd data source): - 5.3.2 (external APFS/HFS+ encryption): apfs_volumes exposes no internal/external indicator. - 5.3.3 (FAT32/ExFAT): CIS Manual audit.
2 lines
148 B
Plaintext
2 lines
148 B
Plaintext
- Updated the macOS CIS benchmark policies to the latest CIS releases: macOS 14 Sonoma v3.1.0, macOS 15 Sequoia v2.1.0, and macOS 26 Tahoe v1.1.0.
|