TMA-MACOS-2.6.5
Ensure Gatekeeper Is Enabled
Description
Gatekeeper is Apple’s application that utilizes allowlisting to restrict downloaded applications from launching. It functions as a control to limit applications from unverified sources from running without authorization. In an update to Gatekeeper in macOS 13 Ventura, Gatekeeper checks every application on every launch, not just quarantined apps.
How it is checked
Audit method: Shell command
/usr/sbin/spctl --status 2>&1- Expected output
assessments enabled
How it is fixed
Fix method: Guidance or infrastructure patch
Profile (preferred): com.apple.systempolicy.control AllowIdentifiedDevelopers = <true/>; com.apple.systempolicy.control EnableAssessment = <true/>. GUI: System Settings > Privacy & Security > Set 'Allow apps downloaded from' to 'App Store and identified developers'.
Properties
- Operating systems
- macos-26
- Tags
- macossystem-settings
- Reference
- CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.6.5 Ensure Gatekeeper Is Enabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target macos