The macOS system must ensure secure boot level set to full.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-259573	SRG-OS-000445-GPOS-00199	APPL-14-005100	SV-259573r958944_rule	2024-12-04	2

Description
The Secure Boot security setting must be set to full. Full security is the default Secure Boot setting in macOS. During startup, when Secure Boot is set to full security, the Mac will verify the integrity of the operating system before allowing the operating system to boot. Note: This will only return a proper result on T2 or Apple Silicon Macs. Satisfies: SRG-OS-000445-GPOS-00199,SRG-OS-000446-GPOS-00200,SRG-OS-000447-GPOS-00201

Description

The Secure Boot security setting must be set to full. Full security is the default Secure Boot setting in macOS. During startup, when Secure Boot is set to full security, the Mac will verify the integrity of the operating system before allowing the operating system to boot. Note: This will only return a proper result on T2 or Apple Silicon Macs. Satisfies: SRG-OS-000445-GPOS-00199,SRG-OS-000446-GPOS-00200,SRG-OS-000447-GPOS-00201

ℹ️ Check
Verify the macOS system is configured to ensure secure boot level set to full using the following command: /usr/libexec/mdmclient QuerySecurityInfo \| /usr/bin/grep -c "SecureBootLevel = full" If the result is not "1", this is a finding.

✔️ Fix
Configure the macOS system to ensure secure boot level set to full by booting into Recovery Mode and enable Full Secure Boot.