TMA-MACOS-1.6

Ensure Software Update Deferment Is Less Than or Equal to 30 Days

HighLevel 1Automatedmacos

Description

Apple provides the capability to manage software updates on Apple devices through mobile device management. Part of those capabilities permit organizations to defer software updates and allow for testing. Many organizations have specialized software and configurations that may be negatively impacted by Apple updates. If software updates are deferred, they should not be deferred for more than 30 days. Audit: No deferral profile (no value) passes, as the benchmark states.

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('enforcedSoftwareUpdateDelay'))
  if ( delay == null || delay <= 30 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.applicationaccess enforcedSoftwareUpdateDelay = <integer><1-30></integer>.

Properties

Operating systems: macos-26
Tags: macossoftware-update
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.6 Ensure Software Update Deferment Is Less Than or Equal to 30 Days

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos