Audit Connected FAT32 and ExFAT Drives

LowLevel 2Manual reviewmacos

Description

While FAT32 and exFAT offer cross-platform convenience, they introduce critical security gaps. These formats do not support encryption without third-party products (on any platform). Consequently, FAT32 and exFAT should be reserved strictly for temporary, non-sensitive data transfers, while any sustained use or sensitive data storage should utilize APFS (Encrypted).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Terminal: diskutil list external | grep -E 'DOS_FAT_32|Microsoft Basic Data' Any FAT32 or ExFAT drives connected should meet your organization's existing device policies for external drives.

How it is fixed

Fix method: Guidance or infrastructure patch

Any connected FAT32 or ExFAT volumes need to be audited to verify that they meet your organization's existing device policies for external drives.

Properties

Operating systems: macos-26
Tags: macossystem-access
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.3.3 Audit Connected FAT32 and ExFAT Drives