TMA-MACOS-1.5

Ensure Install Security Responses and System Files Is Enabled

HighLevel 1Automatedmacos

Description

Ensure that system and security updates are installed after they are available from Apple. This setting enables definition updates for XProtect and Gatekeeper. With this setting in place, new malware and adware that Apple has added to the list of malware or untrusted software will not execute. These updates do not require reboots or end user admin rights.

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('ConfigDataInstall'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('CriticalUpdateInstall'))
  if ( pref1 == 1 && pref2 == 1 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.SoftwareUpdate ConfigDataInstall = <true/>; com.apple.SoftwareUpdate CriticalUpdateInstall = <true/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true. GUI: System Settings > General > Software Update > i > Set Install Security Responses and System files to enabled > Done.

Properties

Operating systems: macos-26
Tags: macossoftware-update
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.5 Ensure Install Security Responses and System Files Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos