--- title: CIS macOS Tahoe Network Configurations: 3 Checks | Wartiva description: Wartiva's 3 checks for section 4, Network Configurations, of the CIS Apple macOS 26 Tahoe Benchmark: what each one finds, why it matters, and how to fix it. url: https://wartiva.com/policy-rules/apple-macos-26-tahoe/network-configurations.html updated: 2026-10-07 --- CIS Apple macOS 26 Tahoe Benchmark · Section 4 # macOS Tahoe Network Configurations: 3 Checks Wartiva runs 3 checks for section 4, Network Configurations, of the CIS Apple macOS 26 Tahoe Benchmark. Each one lists what it finds, why it matters, and how to fix it. Wartiva evaluates these checks on its cloud mirror every time an endpoint changes, with zero endpoint load, and turns every failure into a finding with captured evidence. [How Wartiva works →](https://wartiva.com/platform.html) ## [Ensure Bonjour Advertising Services Is Disabled](https://wartiva.com/policy-rules/apple-macos-26-tahoe/network-configurations.html#bonjour-advertising-services-is-disabled) Medium severity · Wartiva check · CIS Apple macOS 26 Tahoe Benchmark 4 **Finding:** Bonjour advertising services are enabled. Checks whether Bonjour multicast service advertising is disabled. This rule fails when `bonjourAdvertisingDisabled` is not `true`. **Rationale:** Bonjour advertising lets a compromised host discover services and aids targeted attacks. ### Remediation Open **System Settings > General > Device Management** and confirm a profile sets **NoMulticastAdvertisements** to enabled. From the command line: ```sh /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true ``` Framework mappings - **CIS Controls v8**: 4.1 Establish and Maintain a Secure Configuration Process; 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software - **NIST SP 800-53 Rev. 5**: CM-1 Policy and Procedures; CM-2 Baseline Configuration; CM-6 Configuration Settings; CM-7 Least Functionality; CM-9 Configuration Management Plan; SA-3 System Development Life Cycle; SA-8 Security and Privacy Engineering Principles; SA-10 Developer Configuration Management - **NIST SP 800-171 Rev. 2**: 3.1.18 Control connection of mobile devices; 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; 3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **CMMC 2.0 Level 2**: AC.L2-3.1.18 Control connection of mobile devices; CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; CM.L2-3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **PCI DSS v4.0.1**: 1.1.1 Network security control policies and procedures kept documented, current, and applied; 1.2.1 Establish and uphold configuration baselines for NSC rulesets; 1.2.5 Approve and justify each allowed port, protocol, and service; 1.2.6 Add security features that offset risk from active insecure services; 1.2.7 Review NSC configurations for relevance and effectiveness every six months; 1.5.1 Harden dual-connected computing devices that reach both the internet and CDE; 2.1.1 Secure configuration policies and procedures kept documented, current, and applied; 2.2.1 Develop and maintain hardening standards covering all system components; 2.2.4 Enable only required services and remove unneeded functionality; 6.4.1 Assess or shield public-facing web applications against known attacks Risk External Attack Surface MITRE ATT&CK tactic Reconnaissance ([TA0043](https://attack.mitre.org/tactics/TA0043/)) ## [Ensure HTTP Server Is Disabled](https://wartiva.com/policy-rules/apple-macos-26-tahoe/network-configurations.html#http-server-is-disabled) Medium severity · Wartiva check · CIS Apple macOS 26 Tahoe Benchmark 4 **Finding:** The HTTP (Apache) server is running. Checks that the built-in Apache web server launchd job is not running. This rule fails when the `org.apache.httpd` service `state` is `RUNNING`. **Rationale:** Web serving from a user endpoint expands the attack surface and enables unauthorized transfers. ### Remediation From the command line: ```sh /usr/bin/sudo /usr/sbin/apachectl stop /usr/bin/sudo /bin/launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist ``` Framework mappings - **CIS Controls v8**: 4.1 Establish and Maintain a Secure Configuration Process; 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software - **NIST SP 800-53 Rev. 5**: CM-1 Policy and Procedures; CM-2 Baseline Configuration; CM-6 Configuration Settings; CM-7 Least Functionality; CM-9 Configuration Management Plan; SA-3 System Development Life Cycle; SA-8 Security and Privacy Engineering Principles; SA-10 Developer Configuration Management - **NIST SP 800-171 Rev. 2**: 3.1.18 Control connection of mobile devices; 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; 3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **CMMC 2.0 Level 2**: AC.L2-3.1.18 Control connection of mobile devices; CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; CM.L2-3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **PCI DSS v4.0.1**: 1.1.1 Network security control policies and procedures kept documented, current, and applied; 1.2.1 Establish and uphold configuration baselines for NSC rulesets; 1.2.5 Approve and justify each allowed port, protocol, and service; 1.2.6 Add security features that offset risk from active insecure services; 1.2.7 Review NSC configurations for relevance and effectiveness every six months; 1.5.1 Harden dual-connected computing devices that reach both the internet and CDE; 2.1.1 Secure configuration policies and procedures kept documented, current, and applied; 2.2.1 Develop and maintain hardening standards covering all system components; 2.2.4 Enable only required services and remove unneeded functionality; 6.4.1 Assess or shield public-facing web applications against known attacks Risk External Attack Surface MITRE ATT&CK tactic Initial Access ([TA0001](https://attack.mitre.org/tactics/TA0001/)) ## [Ensure NFS Server Is Disabled](https://wartiva.com/policy-rules/apple-macos-26-tahoe/network-configurations.html#nfs-server-is-disabled) Medium severity · Wartiva check · CIS Apple macOS 26 Tahoe Benchmark 4 **Finding:** The NFS server is running. Checks that the NFS fileserver launchd job (com.apple.nfsd) is not running. This rule fails when the `com.apple.nfsd` service `state` is `RUNNING`. **Rationale:** File serving from a user endpoint expands the attack surface and enables unauthorized transfers. ### Remediation From the command line: ```sh /usr/bin/sudo /bin/launchctl disable system/com.apple.nfsd ``` Framework mappings - **CIS Controls v8**: 4.1 Establish and Maintain a Secure Configuration Process; 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software - **NIST SP 800-53 Rev. 5**: CM-1 Policy and Procedures; CM-2 Baseline Configuration; CM-6 Configuration Settings; CM-7 Least Functionality; CM-9 Configuration Management Plan; SA-3 System Development Life Cycle; SA-8 Security and Privacy Engineering Principles; SA-10 Developer Configuration Management - **NIST SP 800-171 Rev. 2**: 3.1.18 Control connection of mobile devices; 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; 3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **CMMC 2.0 Level 2**: AC.L2-3.1.18 Control connection of mobile devices; CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems; CM.L2-3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services - **PCI DSS v4.0.1**: 1.1.1 Network security control policies and procedures kept documented, current, and applied; 1.2.1 Establish and uphold configuration baselines for NSC rulesets; 1.2.5 Approve and justify each allowed port, protocol, and service; 1.2.6 Add security features that offset risk from active insecure services; 1.2.7 Review NSC configurations for relevance and effectiveness every six months; 1.5.1 Harden dual-connected computing devices that reach both the internet and CDE; 2.1.1 Secure configuration policies and procedures kept documented, current, and applied; 2.2.1 Develop and maintain hardening standards covering all system components; 2.2.4 Enable only required services and remove unneeded functionality; 6.4.1 Assess or shield public-facing web applications against known attacks Risk External Attack Surface MITRE ATT&CK tactic Initial Access ([TA0001](https://attack.mitre.org/tactics/TA0001/)) --- Wartiva is in early access. Request access: https://wartiva.com/early-access.html All pages: https://wartiva.com/llms.txt