Ensure Signed System Volume (SSV) Is Enabled

HighLevel 1Automatedmacos

Description

Signed System Volume is a security feature introduced in macOS 11.0 Big Sur. During system installation, a SHA-256 cryptographic hash is calculated for all immutable system files and stored in a Merkle tree which itself is hashed as the Seal. Both are stored in the metadata of the snapshot created of the System volume. The seal is verified by the boot loader at startup.

How it is checked

Audit method: Shell command

shell

/usr/bin/csrutil authenticated-root status 2>/dev/null

Expected output: Authenticated Root status: enabled

How it is fixed

Fix method: Guidance or infrastructure patch

If SSV has been disabled, assume that the operating system has been compromised. Back up any files, and do a clean install to a known good Operating System.

Properties

Operating systems: macos-26
Tags: macossystem-access
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.1.4 Ensure Signed System Volume (SSV) Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos