DISA (Defense Information Systems Agency) publishes Security Technical Implementation Guides (STIGs) that define security configurations for federal systems, including macOS. The 2025 STIG updates bring important changes that affect how government Macs must be configured. Here’s what changed and how to ensure your Mac stays compliant.
Understanding Mac STIGs
What Are STIGs?
Security Technical Implementation Guides are:
- Configuration standards developed by DISA
- Required for DoD systems
- Adopted by many civilian agencies
- Updated regularly with new security requirements
- Specific to operating systems, applications, and devices
macOS STIG Structure
The macOS STIG contains:
- Rules: Specific configuration requirements
- Severity ratings: CAT I (High), CAT II (Medium), CAT III (Low)
- Check procedures: How to verify compliance
- Fix procedures: How to remediate non-compliance
- Discussion: Rationale for each requirement
Key Changes in 2025 STIGs
macOS Sonoma Requirements
The 2025 STIGs address macOS Sonoma (14.x) with updates including:
- New system extension security requirements
- Updated FileVault configuration mandates
- Enhanced Gatekeeper enforcement
- Revised password complexity rules
- Updated audit logging requirements
Authentication Changes
Significant updates to authentication requirements:
- Strengthened smart card (CAC/PIV) enforcement
- Updated password expiration policies
- New requirements for Touch ID restrictions
- Enhanced screen lock timeout rules
- Updated session management requirements
Privacy and Security Controls
New and updated controls for:
- Location Services restrictions
- Bluetooth configuration requirements
- Camera and microphone privacy
- iCloud and cloud service restrictions
- Sharing service limitations
How STIGs Affect Your Mac
What You’ll Notice
STIG compliance may result in:
- Password changes required more frequently
- Stricter password complexity requirements
- Screen locks after shorter idle periods
- Some features disabled or restricted
- CAC required for more operations
Restricted Features
STIG compliance typically restricts:
- iCloud services and syncing
- AirDrop file transfers
- Screen sharing to unauthorized parties
- Bluetooth device pairing
- Guest user accounts
- Automatic login
Compliance Verification
Automated Scanning
Your agency likely uses automated tools to verify STIG compliance:
- SCAP tools: Security Content Automation Protocol scanners
- Nessus: Vulnerability and compliance scanning
- JAMF Compliance: MDM-based STIG enforcement
- osquery: Endpoint visibility and compliance
Manual Verification
Some STIG rules require manual review:
- Physical security measures
- Policy acknowledgments
- Administrative procedures
- Documentation requirements
Common STIG Requirements
Password Policy
- Minimum 15 characters (increased from 14)
- Mix of uppercase, lowercase, numbers, special characters
- Password history prevents reuse of last 5 passwords
- Maximum password age of 60 days
- Account lockout after failed attempts
Screen Lock
- Automatic lock after 15 minutes of inactivity
- Immediate lock available via hot corners or keyboard
- Password required to wake from sleep
- Screen saver with password protection
Encryption
- FileVault must be enabled
- Recovery keys escrowed with IT
- Secure boot configuration required
- Firmware password may be required
Audit Logging
- Security audit logging enabled
- Log retention periods specified
- Centralized log collection
- Tamper protection for logs
Staying Compliant
Your Responsibilities
- Don’t attempt to bypass security controls
- Report issues through proper channels
- Keep your Mac enrolled in MDM
- Allow security scans to complete
- Update when prompted by IT
What IT Handles
- Pushing STIG-compliant configurations
- Monitoring compliance status
- Remediating non-compliant settings
- Managing exceptions when justified
- Reporting compliance to security teams
Exception Requests
If a STIG requirement prevents you from doing your job:
- Document the specific STIG rule causing issues
- Explain the mission impact
- Describe what you need to accomplish
- Submit a formal exception request through IT
- Propose mitigating controls if possible
Exception approval requires security officer review and is granted only when mission need outweighs risk.
Resources for STIG Information
Official Sources
- DISA STIG Library: public.cyber.mil/stigs/
- NIST Security Guides: nist.gov/cyberframework
- Apple Platform Security: support.apple.com/guide/security
Tools and Documentation
- STIG Viewer application (from DISA)
- macOS Security Compliance Project (GitHub)
- Agency-specific STIG implementation guides
Planning for Updates
STIG updates happen regularly:
- New macOS versions get new STIGs
- Quarterly STIG updates address new threats
- Your agency coordinates STIG rollouts
- Plan for potential disruption during updates
STIG compliance is essential for protecting federal systems and data. While the requirements may sometimes feel restrictive, they represent the security baseline necessary to defend against sophisticated threats targeting government networks. Understanding STIGs helps you work effectively within these important security controls.
