Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices

中等級 2自動化macos

說明

MacBooks should be set so that the sleep is 15 minutes or less and the display should sleep at 10 minutes or less. This setting should allow laptop users in most cases to stay within physically secured areas while going to a conference room, auditorium, or other internal location without having to unlock the encryption. When the user goes home at night, the laptop will auto-sleep after 15 minutes and to log back into the system when it resumes. Note: If the screen saver is properly configured to the benchmark (15 minutes or less), then this recommendation will also pass no matter the sleep and displaysleep setting. Laptops should sleep 15 minutes or less after sleeping.

檢查方式

稽核方法: Shell 指令

shell

[ -x /usr/sbin/ioreg ] || exit 1
m=$(/usr/sbin/ioreg -k product-name | /usr/bin/awk -F '"' '/product-name/ { if ( $0 ~ "MacBook" ) { print $4 } }')
[ -n "$m" ] || { echo compliant; exit 0; }
/usr/sbin/sysctl -n machdep.cpu.brand_string | /usr/bin/grep -q Apple || { echo compliant; exit 0; }
s=$(/usr/bin/pmset -b -g | /usr/bin/awk '$1 == "sleep" {print $2}')
d=$(/usr/bin/pmset -b -g | /usr/bin/awk '$1 == "displaysleep" {print $2}')
if [ -n "$s" ] && [ -n "$d" ] && [ "$s" -le 15 ] && [ "$d" -le 10 ] && [ "$d" -le "$s" ]; then echo compliant; else echo "sleep=$s displaysleep=$d"; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Terminal Method: Run the following command to set the sleep time and hibernate mode: % /usr/bin/sudo /usr/bin/pmset -a sleep <value≤15> % /usr/bin/sudo /usr/bin/pmset -a displaysleep <value≤10 & < value of sleep> example: % /usr/bin/sudo /usr/bin/pmset -a sleep 15 % /usr/bin/sudo /usr/bin/pmset -a displaysleep 10

屬性

作業系統: macos-14
標籤: macossonoma
參考資料: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.9.1.2 Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos --level 2