The macOS system must enable gatekeeper.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-277120	APPL-26-002064	SV-277120r1148812_rule	CCI-003992	high
Description
Gatekeeper must be enabled. Gatekeeper is a security feature that ensures that applications are digitally signed by an Apple-issued certificate before they are permitted to run. Digital signatures allow the macOS host to verify the application has not been modified by a malicious third party. Administrator users will still have the option to override these settings on a case-by-case basis.
STIG			Date
Apple macOS 26 (Tahoe) Security Technical Implementation Guide			2026-05-23

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.2Signed Components

0.50

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-14Signed Components

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(3)Signed Components

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(5)Authorized Software — Allow-by-exception

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(5)Individual Authentication with Group Authentication

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-3Security Function Isolation

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SI-2Flaw Remediation

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-003992

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)

Details

Check Text (C-277120r1148812_chk)

Verify the macOS system is configured to enable gatekeeper with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment').js EOS If the result is not "true", this is a finding.

Fix Text (F-81180r1148811_fix)

Configure the macOS system to enable gatekeeper by installing the "com.apple.systempolicy.control" configuration profile.