Compliance Benchmarks Update - September 2025

os_mail_smart_reply_disable

New rule added for CMMC, disables smart reply feature in Mail app [1].

os_notes_transcription_disable

New rule added, disables Notes audio transcription (CIS & CMMC).

os_notes_transcription_summary_disable

New rule added, disables summary for Notes transcription (CIS & CMMC).

os_safari_reader_summary_disable

New rule disables Safari reader summaries for CMMC; summary attribute alignment.

os_sshd_per_source_penalties_configure

New rule for SSH security; sets per-source penalties. No CIS/CMMC/STIG mapping. [1]

os_genmoji_disable

Added for CMMC/STIG; disables Apple “Genmoji” (AI emoji).

os_implement_cryptography

Inherent; further clarified compliance mapping but no direct code change.

os_iphone_mirroring_disable

Updated: Added for CMMC; disables iPhone mirroring support.

os_mail_summary_disable

Refined check logic/title to match CIS/CMMC language [1].

os_nfsd_disable

Alignment update: ensures consistent disabling for all three benchmarks.

os_parental_controls_enable

No substantial recent changelog update published.

os_password_hint_remove

Logic updated: Better string matching/check for password hints [1].

os_power_nap_disable

Platform logic updated for newer Mac architectures.

os_separate_functionality

Inherent; clarification in rule mapping.

os_sleep_and_display_sleep_apple_silicon_enable

New ARM tag; tailored to Apple Silicon (ARM64) only.

os_sudo_log_enforce

Added STIG IDs, NIST 800-53 tags; enhanced compliance remediations.

os_time_server_enabled

Updated checks: Precise enforcement for time server enabling.

os_unlock_active_user_session_disable

Expanded to all three: Alignment with broader compliance sets.

os_writing_tools_disable

Added as new rule; disables AI-driven writing tools.

pwpolicy_50_percent

(Permanent) No changelog note for recent change.

pwpolicy_history_enforce

Clarified checks: Enhanced password reuse prevention logic.

pwpolicy_upper_case_character_enforce

No recent changelog update available.

supplemental_cis_manual

Not present in repo; no entry.

system_settings_automatic_login_disable

Expanded mapping: Linux/Mac parity, more detection logic.

system_settings_bluetooth_sharing_disable

Minor logic improvement for reliability.

system_settings_content_caching_disable

Logic refinement for content caching checks.

system_settings_external_intelligence_disable

Addition for CIS; disables sharing diagnostic intelligence.

system_settings_external_intelligence_sign_in_disable

Addition for CIS; disables external intelligence sign-in.

system_settings_guest_access_smb_disable

Logic/description update: Better checks for SMB guest sharing.

system_settings_guest_account_disable

Improved check/fix logic for disabling Mac guest accounts.

system_settings_improve_assistive_voice_disable

Logic updated for clarity/consistency.

system_settings_improve_search_disable

Title/check logic refined for CMMC; disables Apple data sharing.

system_settings_internet_sharing_disable

Remediation refined: Stronger check and disable.

system_settings_loginwindow_loginwindowtext_enable

Added/Refined for CIS only.

system_settings_loginwindow_prompt_username_password_enforce

Expanded/clarified: Stronger universal prompting enforcement.

system_settings_media_sharing_disabled

Remediation improved: Now enforced for more frameworks.

system_settings_password_hints_disable

Check/refinement: Improved password hints detection.

system_settings_printer_sharing_disable

Logic improved: Stronger disabling coverage.

system_settings_rae_disable

Remediation alignment for all three frameworks.

system_settings_remote_management_disable

Logic refined: Broader platform compatibility.

system_settings_screen_sharing_disable

Remediation improvement: More robust disabling logic.

system_settings_screensaver_ask_for_password_delay_enforce

Check alignment to benchmark language.

system_settings_screensaver_timeout_enforce

Title updated/logic improved for timeout enforce.

system_settings_siri_disable

Logic aligned: Siri and Apple intelligence off.

system_settings_siri_listen_disable

No recent changelog found.

system_settings_smbd_disable

Logic remediation update for SMB sharing.

system_settings_software_update_enforce

Enhanced OS version targeting.

system_settings_ssh_disable

Logic alignment: SSH disable improved coverage.

system_settings_time_server_configure

Logic refinement: Stronger enforcement.

system_settings_time_server_enforce

Logic refinement: More robust enforcement.

system_settings_wake_network_access_disable

Logic update/clarification for newer Macs.