Macintosh OS X Workstation STIG, V1R1 

DISA Field Security Operations 

15 June 2004 

Developed by DISA for the DOD 

(OSX1026PYS0003:  CAT II) The IAO and SA will ensure that all Mac OS X systems are 

configured, where possible, to require a password for access to single user and maintenance 

modes. 

(OSX1026PYS0003:  CAT II) The following requirements will apply to all Mac OS X systems 

that cannot be configured for password access to single user and maintenance modes: 

   The IAO will maintain a list of all such systems. 

   Each system will be protected in a manner that precludes physical access by anyone but 

authorized System Administrators. 

   A maintenance log noting the date, time of day, name of authorized System 

Administrator(s), and purpose for single user or maintenance mode access will be 

maintained for each system. 

2.2  Software Integrity 

2.2.1  Free and Open Source Operating System Software 

Open Source Software 

DOD has clarified policy on the use of open source software to take advantage of the capabilities 

available in the Open Source community as long as certain prerequisites are met.  DOD no 

longer requires that operating system software be obtained through a valid vendor channel and 

have a formal support path if the source code for the operating system is publicly available for 

review. 

Open source software takes several forms: 

1.  A utility that has publicly available source code is acceptable. 

2.  A commercial product that incorporates open source software is acceptable because the 

commercial vendor provides a warranty. 

3.  Vendor supported open source software is acceptable. 

4.  A utility that comes compiled and has no warranty is not acceptable. 

Mac OS X is acceptable based on the availability of source code, in some instances, and the 

support and guarantee of the vendor (i.e., Redhat) and the support and guarantee of vendors who 

incorporate the software in their common release.  However, any operating system in use in a 

production environment must be capable of STIG compliance as verified by an SRR.  Operating 

systems are still subject to the requirements for NIAP certification described in DODI 8500.2. 

5

UNCLASSIFIED