The macOS system must ensure System Integrity Protection (SIP) is enabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-277165 | APPL-26-005001 | SV-277165r1149180_rule | CCI-000154 | high |
| Description | ||||
| SIP is vital to protecting the integrity of the system as it prevents malicious users and software from making unauthorized and/or unintended modifications to protected files and folders; ensures the presence of an audit record generation capability for defined auditable events for all operating system components; protects audit tools from unauthorized access, modification, and deletion; restricts the root user account and limits the actions that the root user can perform on protected parts of the macOS; and prevents nonprivileged users from granting other users direct access to the contents of their home directories and folders. Note: SIP is enabled by default in macOS. Satisfies: SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000062-GPOS-00031, SRG-OS-000080-GPOS-00048, SRG-OS-000122-GPOS-00063, SRG-OS-000138-GPOS-00069, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000259-GPOS-00100, SRG-OS-000278-GPOS-00108, SRG-OS-000350-GPOS-00138 | ||||
| STIG | Date | |||
| Apple macOS 26 (Tahoe) Security Technical Implementation Guide | 2026-02-11 | |||
Details
Check Text (C-277165r1149180_chk)
Verify the macOS system is configured to enable SIP with the following command:
/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.'
If the result is not "1", this is a finding.
Fix Text (F-81225r1149179_fix)
To configure the macOS system to enable SIP, boot into "Recovery" mode, launch "Terminal" from the "Utilities" menu, and run the following command:
/usr/bin/csrutil enable