Policy Rules
CIS Apple macOS 26 Tahoe Benchmark: 90 Checks
CIS Benchmark checks for Apple macOS 26 Tahoe: software updates, System Settings, logging and auditing, network configuration, system access, and applications.
The Center for Internet Security (CIS) is a nonprofit that publishes the CIS Benchmarks: consensus-developed secure configuration guides for operating systems, cloud platforms, and applications. Each benchmark enumerates numbered recommendations, most assigned a Level 1 (broadly safe hardening) or Level 2 (defense-in-depth, may reduce functionality) profile, together with the audit procedure and remediation for each. Wartiva maps a benchmark's recommendations onto policy rules so an endpoint's observed configuration can be assessed against the published baseline.
- High 19
- Medium 49
- Low 22
No checks match your filter.
1 Install Updates 6 checks
- Ensure Apple-Provided Software Updates Are Installed
- Ensure Download New Updates When Available Is Enabled
- Ensure Install Application Updates From the App Store Is Enabled
- Ensure Install of macOS Updates Is Enabled
- Ensure Install Security Responses and System Files Is Enabled
- Ensure Software Update Deferment Is 30 Days or Less
2 System Settings 47 checks
- Ensure iCloud Drive Document and Desktop Sync Is Disabled
- Ensure Firewall Stealth Mode Is Enabled
- Ensure the Application Firewall Is Enabled
- Ensure AirDrop Is Disabled
- Ensure AirPlay Receiver Is Disabled
- Ensure Set Time and Date Automatically Is Enabled
- Ensure Bluetooth Sharing Is Disabled
- Ensure Content Caching Is Disabled
- Ensure File Sharing Is Disabled
- Ensure Internet Sharing Is Disabled
- Ensure Media Sharing Is Disabled
- Ensure Printer Sharing Is Disabled
- Ensure Remote Apple Events Is Disabled
- Ensure Remote Login Is Disabled
- Ensure Remote Management Is Disabled
- Ensure Screen Sharing Is Disabled
- Ensure Time Machine Automatic Backup Is Enabled
- Ensure Time Machine Volumes Are Encrypted
- Ensure Apple Intelligence Writing Tools Are Disabled
- Ensure External Intelligence Extensions Are Disabled
- Ensure Mail Summarization Is Disabled
- Ensure Notes Summarization Is Disabled
- Ensure Listen For Siri Is Disabled
- Ensure Siri Is Disabled
- Ensure An Administrator Password Is Required To Access System-Wide Preferences
- Ensure FileVault Is Enabled
- Ensure Gatekeeper Is Enabled
- Ensure Limit Ad Tracking Is Enabled
- Ensure Location Icon Is Shown When System Services Request Location
- Ensure Location Services Is Enabled
- Ensure Improve Siri And Dictation Is Disabled
- Ensure Share Mac Analytics Is Disabled
- Ensure Share With App Developers Is Disabled
- Ensure Screen Saver Hot Corners Do Not Disable The Screen Saver
- Ensure Help Apple Improve Search Is Disabled
- Ensure Power Nap Is Disabled
- Ensure Wake for Network Access Is Disabled
- Ensure Sleep and Display Sleep Are Enabled
- Ensure a Custom Login Screen Message Is Configured
- Ensure a Password Is Required After Screen Saver or Display Sleep
- Ensure Password Hints Are Not Shown at the Login Window
- Ensure Screen Saver Inactivity Interval Is 15 Minutes or Less
- Ensure the Login Window Displays Name and Password
- Ensure User Accounts Do Not Have a Password Hint
- Ensure Automatic Login Is Disabled
- Ensure the Guest Account Is Disabled
- Ensure On-Device Dictation Is Enabled
3 Logging and Auditing 4 checks
4 Network Configurations 3 checks
5 System Access 22 checks
- Ensure a Login Window Banner Exists
- Ensure a Separate Timestamp Is Enabled for Each User/tty Combo
- Ensure Logging Is Enabled for Sudo
- Ensure the "root" Account Is Disabled
- Ensure the Guest Home Folder Does Not Exist
- Ensure the Sudo Timeout Period Is Set to Zero
- Ensure XProtect Is Running
- Ensure Apple Mobile File Integrity Is Enabled
- Ensure Home Folders Are Secure
- Ensure Signed System Volume Is Enabled
- Ensure System Integrity Protection Is Enabled
- Ensure System-Wide Applications Are Not World-Writable
- Ensure Password Account Lockout Threshold Is Configured
- Ensure Password Age Is Configured
- Ensure Password History Is Configured
- Ensure Password Minimum Length Is Configured
- Ensure Passwords Must Contain a Numeric Character
- Ensure Passwords Must Contain a Special Character
- Ensure Passwords Must Contain an Alphabetic Character
- Ensure Passwords Must Contain Uppercase and Lowercase Characters
- Ensure External Storage Volumes Are Encrypted
- Ensure the Startup Volume Is Encrypted
6 Applications 8 checks
- Ensure Show All Filename Extensions Is Enabled
- Ensure Automatic Opening of Safe Files in Safari Is Disabled
- Ensure Safari Advertising Privacy Protection Is Enabled
- Ensure Safari Prevents Cross-Site Tracking
- Ensure Safari Shows the Full Website Address
- Ensure Safari Status Bar Is Shown
- Ensure Safari Warns When Visiting a Fraudulent Website
- Ensure Terminal Secure Keyboard Entry Is Enabled
See your environment the way it really exists
Wartiva is in early access. Request your spot and talk to the team that built the endpoint platform they always wished they had.