Audit Touch ID

LowLevel 1Manual reviewmacos

Description

Apple has integrated Touch ID with macOS and allows fingerprint use for many common operations. All use of Touch ID requires the presence of a password and the use of that password after every reboot, or when more than 48 hours has elapsed since the device was last unlocked. Touch ID is not a password replacement.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

GUI: System Settings > Touch ID & Password > Verify the Touch ID settings match your organization's requirements. Terminal: sudo -u <username> /usr/bin/bioutil -r ; sudo /usr/bin/bioutil -r -s | /usr/bin/awk '/timeout/'

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: sudo -u <username> /usr/bin/bioutil -w -u <0,1> ; sudo -u <username> /usr/bin/bioutil -w -a <0,1> ; sudo usr/bin/bioutil -w -s -o <value≤172800>. GUI: System Settings > Touch ID & Password > Set the Touch ID settings to your organization's requirements.

Properties

Operating systems: macos-26
Tags: macossystem-settings
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.12.2 Audit Touch ID