macOS 15 STIG

17 items · Security · Medium difficulty · 2 hours

Harden macOS 15 with essential STIG-based security steps.

• Enable FileVault full-disk encryption

  Encrypt the startup disk to protect data at rest.

• Store FileVault recovery key in a secure location

  Save recovery key to a company KMS or trusted password manager.

• Enable the macOS firewall

  Turn on the built-in firewall to block unsolicited inbound traffic.

• Set firewall to stealth mode

  Hide the Mac from unsolicited network probes.

• Disable automatic login

  Require user credentials at boot to prevent local access.

• Require password immediately after sleep or screen saver

  Set to require password on wake or screensaver activation.

• Configure a strong password policy

  Enforce minimum 12 chars, complexity, and account lockout.

• Enable automatic system software updates

  Turn on automatic checking and downloading of updates.

• Enable automatic installation of critical security updates

  Allow the system to install security patches without manual steps.

• Verify macOS version and apply latest security patches

  Confirm current build and install any outstanding updates.

• Review remote access and remote management settings

  Decide whether Remote Login, Remote Management, or screen sharing are necessary.

• If remote access required, configure SSH to key-only and limit users

  Disable password auth and restrict allowed users/groups.

• Verify System Integrity Protection (SIP) is enabled

  Ensure SIP is active to protect core OS components.

• Disable Guest user accounts and shared guest access

  Turn off Guest in Users & Groups and revoke guest sharing permissions.

• Disable AirDrop, Bluetooth, and other wireless services when unused

  Turn off radios to reduce attack surface when not required.

• Configure system time synchronization to trusted NTP servers

  Use approved NTP servers to ensure accurate logs and cert validity.

• Enable Gatekeeper and require app notarization

  Allow only apps from identified developers and notarized software.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.