Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices

中レベル 2自動macos

説明

MacBooks should be set so that the sleep is 15 minutes or less and the display should sleep at 10 minutes or less. This setting should allow laptop users in most cases to stay within physically secured areas while going to a conference room, auditorium, or other internal location without having to unlock the encryption. When the user goes home at night, the laptop will auto-sleep after 15 minutes and to log back into the system when it resumes. Note: If the screen saver is properly configured to the benchmark (15 minutes or less), then this recommendation will also pass no matter the sleep and displaysleep setting. Laptops should sleep 15 minutes or less after sleeping.

チェック方法

監査方法: シェルコマンド

shell

[ -x /usr/sbin/ioreg ] || exit 1
m=$(/usr/sbin/ioreg -k product-name | /usr/bin/awk -F '"' '/product-name/ { if ( $0 ~ "MacBook" ) { print $4 } }')
[ -n "$m" ] || { echo compliant; exit 0; }
/usr/sbin/sysctl -n machdep.cpu.brand_string | /usr/bin/grep -q Apple || { echo compliant; exit 0; }
s=$(/usr/bin/pmset -b -g | /usr/bin/awk '$1 == "sleep" {print $2}')
d=$(/usr/bin/pmset -b -g | /usr/bin/awk '$1 == "displaysleep" {print $2}')
if [ -n "$s" ] && [ -n "$d" ] && [ "$s" -le 15 ] && [ "$d" -le 10 ] && [ "$d" -le "$s" ]; then echo compliant; else echo "sleep=$s displaysleep=$d"; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Terminal Method: Run the following command to set the sleep time and hibernate mode: % /usr/bin/sudo /usr/bin/pmset -a sleep <value≤15> % /usr/bin/sudo /usr/bin/pmset -a displaysleep <value≤10 & < value of sleep> example: % /usr/bin/sudo /usr/bin/pmset -a sleep 15 % /usr/bin/sudo /usr/bin/pmset -a displaysleep 10

プロパティ

オペレーティングシステム: macos-14
タグ: macossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.9.1.2 Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target macos --level 2