---
title: "Baseline settings by framework"
description: "Every setting each Outpost framework baseline sets, with its floor or recommended value, the platforms it applies to, and the control it cites."
url: "https://support.outpostplatform.com/compliance/framework-settings/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "Reference of every setting each framework baseline sets in Outpost Depot 0.8.0: SOC 2, HIPAA, PCI DSS 4.0, CJIS, NIST SP 800-171, NIST SP 800-53 Rev 5, CMMC Level 2, ISO/IEC 27001 (enforced floors), and DISA STIG and the Microsoft security baseline (advisory recommended values). One table per framework: setting key, platforms, value, cited control."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/framework-settings.md"
license: "CC BY 4.0"
---

# Baseline settings by framework

This page lists every setting each framework baseline sets, as shipped in
Depot 0.8.0. For what a floor is and how baselines are assigned, see
[Compliance framework baselines](/compliance/framework-baselines/).

## Scope

- The values come from the Outpost settings catalog, which is the only source
  the baselines and the compliance pages read. When the catalog changes in a
  release, the built-in baselines update with it.
- CIS Benchmarks has no table because Outpost ships no CIS content.
- The control column is the framework's own identifier for the control the
  value supports. The full citation, including how Outpost reads the control
  and why it chose the value, appears in the console: on the setting's
  framework badge in a profile's **Settings** tab, and at the top of the
  control's page under **Compliance**.

## How to read the tables

| Column | Meaning |
| --- | --- |
| **Setting** | The setting key, as the console shows it in profiles and on the compliance pages. |
| **Platforms** | The operating systems the setting applies to. **All** means every operating system with policy enforcement: Windows, Linux, and macOS. **iOS, Android** means managed phones and tablets. **Depot** means the setting governs records Outpost keeps, not an endpoint. |
| **Floor** | For an enforced framework, the least strict value the setting can resolve to. A stricter value in your own profiles is kept. |
| **Recommended value** | For an advisory framework, the value its profile sets. Your own profiles can override it. |
| **Control** | The control, requirement, or rule the framework cites. |

Units follow the key name: a key ending in `_seconds` is in seconds, `_days`
in days, and `_bytes` in bytes. `true` means on and `false` means off.

macOS support is a preview. See
[Platform support](/get-started/platform-support/).

## SOC 2 {#soc-2}

Profile **SOC 2 Baseline**. The console labels this framework **SOC 2**. Enforced: 60 floors across 9 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | CC6.8 |
| `antimalware.real_time_protection` | Windows | `true` | CC6.8 |
| `antimalware.tamper_protection` | Windows | `true` | CC6.8 |
| `audit.linux_auditd_enabled` | Linux | `true` | CC7.2 |
| `audit.logon_events` | Windows | `true` | CC7.2 |
| `audit.policy_change` | Windows | `true` | CC7.2 |
| `compliance.endpoint_audit_retention_days` | Depot | `365` | CC7.3 |
| `compliance.evidence_retention_days` | Depot | `365` | CC4.1 |
| `device_activity.alert_on_driver_change` | All | `true` | CC7.1 |
| `device_activity.alert_on_service_change` | All | `true` | CC7.1 |
| `device_activity.alert_on_usb_storage` | All | `true` | CC6.1 |
| `device_activity.enabled` | All | `true` | CC6.1 |
| `device_control.usb_storage_policy` | Windows | `read_only` | CC6.7 |
| `encryption.escrow_recovery_key` | All | `true` | CC6.1 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | CC6.1 |
| `encryption.macos_require_filevault` | macOS | `true` | CC6.1 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | CC6.1 |
| `firewall.default_inbound_action` | Windows | `block` | CC6.6 |
| `firewall.enabled_domain_profile` | Windows | `true` | CC6.6 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | CC6.6 |
| `firewall.enabled_public_profile` | Windows | `true` | CC6.6 |
| `firewall.linux_enabled` | Linux | `true` | CC6.6 |
| `firewall.macos_enabled` | macOS | `true` | CC6.6 |
| `lockout.duration_seconds` | Windows | `900` | CC6.1 |
| `lockout.linux_duration_seconds` | Linux | `900` | CC6.1 |
| `lockout.linux_threshold_attempts` | Linux | `10` | CC6.1 |
| `lockout.macos_duration_seconds` | macOS | `900` | CC6.1 |
| `lockout.macos_threshold_attempts` | macOS | `10` | CC6.1 |
| `lockout.threshold_attempts` | Windows | `10` | CC6.1 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | CC7.2 |
| `monitoring.alert_on_service_stop` | All | `true` | CC7.2 |
| `monitoring.log_retention_days` | All | `365` | CC7.3 |
| `password.complexity_enabled` | Windows | `true` | CC6.1 |
| `password.history_count` | Windows | `4` | CC6.1 |
| `password.linux_max_age_days` | Linux | `90` | CC6.1 |
| `password.linux_min_character_classes` | Linux | `3` | CC6.1 |
| `password.linux_min_length` | Linux | `12` | CC6.1 |
| `password.macos_history_count` | macOS | `4` | CC6.1 |
| `password.macos_max_age_days` | macOS | `90` | CC6.1 |
| `password.macos_min_character_classes` | macOS | `3` | CC6.1 |
| `password.macos_min_length` | macOS | `12` | CC6.1 |
| `password.max_age_days` | Windows | `90` | CC6.1 |
| `password.min_length` | Windows, macOS | `12` | CC6.1 |
| `patch.auto_approve_critical` | All | `true` | CC7.1 |
| `patch.auto_approve_security` | All | `true` | CC7.1 |
| `remote_access.file_transfer` | All | `to_endpoint` | CC6.7 |
| `script_execution.log_script_output` | All | `true` | CC7.2 |
| `script_execution.require_signed_scripts` | All | `true` | CC8.1 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | CC6.1 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | CC6.1 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | CC6.1 |
| `session.require_password_on_wake` | Windows, macOS | `true` | CC6.1 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | CC6.1 |
| `session.screensaver_enabled` | Windows | `true` | CC6.1 |
| `software.allow_user_installs` | Windows | `false` | CC6.8 |
| `software.installer_signature_required` | All | `true` | CC8.1 |
| `uac.enabled` | Windows | `true` | CC6.1 |
| `updates.automatic_security_updates` | Linux | `true` | CC7.1 |
| `updates.macos_automatic_security_updates` | macOS | `true` | CC7.1 |

## HIPAA Security Rule {#hipaa}

Profile **HIPAA Baseline**. The console labels this framework **HIPAA**. Enforced: 42 floors across 12 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | 164.308(a)(5)(ii)(B) |
| `antimalware.real_time_protection` | Windows | `true` | 164.308(a)(5)(ii)(B) |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | 164.308(a)(5)(ii)(B) |
| `audit.linux_auditd_enabled` | Linux | `true` | 164.312(b) |
| `audit.logon_events` | Windows | `true` | 164.312(b) |
| `audit.policy_change` | Windows | `true` | 164.312(b) |
| `compliance.endpoint_audit_retention_days` | Depot | `2190` | 164.316(b)(2)(i) |
| `compliance.evidence_retention_days` | Depot | `2190` | 164.316(b)(2)(i) |
| `device_activity.alert_on_usb_storage` | All | `true` | 164.310(d)(2)(iii) |
| `device_control.usb_storage_encryption_required` | Windows | `true` | 164.312(a)(2)(iv) |
| `device_control.usb_storage_policy` | Windows | `read_only` | 164.310(d)(1) |
| `encryption.escrow_recovery_key` | All | `true` | 164.308(a)(7)(ii)(A) |
| `encryption.linux_require_disk_encryption` | Linux | `true` | 164.312(a)(2)(iv) |
| `encryption.macos_require_filevault` | macOS | `true` | 164.312(a)(2)(iv) |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | 164.312(a)(2)(iv) |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | 164.312(a)(2)(iv) |
| `firewall.enabled_domain_profile` | Windows | `true` | 164.308(a)(1)(ii)(B) |
| `firewall.linux_enabled` | Linux | `true` | 164.308(a)(1)(ii)(B) |
| `firewall.macos_enabled` | macOS | `true` | 164.308(a)(1)(ii)(B) |
| `lockout.linux_threshold_attempts` | Linux | `10` | 164.308(a)(5)(ii)(C) |
| `lockout.macos_threshold_attempts` | macOS | `10` | 164.308(a)(5)(ii)(C) |
| `lockout.threshold_attempts` | Windows | `10` | 164.308(a)(5)(ii)(C) |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | 164.308(a)(4)(ii)(C) |
| `monitoring.log_retention_days` | All | `2190` | 164.316(b)(2)(i) |
| `password.complexity_enabled` | Windows | `true` | 164.308(a)(5)(ii)(D) |
| `password.linux_max_age_days` | Linux | `90` | 164.308(a)(5)(ii)(D) |
| `password.linux_min_character_classes` | Linux | `3` | 164.308(a)(5)(ii)(D) |
| `password.linux_min_length` | Linux | `12` | 164.308(a)(5)(ii)(D) |
| `password.macos_max_age_days` | macOS | `90` | 164.308(a)(5)(ii)(D) |
| `password.macos_min_character_classes` | macOS | `3` | 164.308(a)(5)(ii)(D) |
| `password.macos_min_length` | macOS | `12` | 164.308(a)(5)(ii)(D) |
| `password.max_age_days` | Windows | `90` | 164.308(a)(5)(ii)(D) |
| `password.min_length` | Windows, macOS | `12` | 164.308(a)(5)(ii)(D) |
| `patch.auto_approve_critical` | All | `true` | 164.308(a)(1)(ii)(B) |
| `remote_access.file_transfer` | All | `to_endpoint` | 164.310(d)(1) |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | 164.312(a)(2)(iii) |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | 164.312(a)(2)(iii) |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | 164.312(a)(2)(iii) |
| `session.require_password_on_wake` | Windows, macOS | `true` | 164.312(a)(2)(iii) |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | 164.312(a)(2)(iii) |
| `session.screensaver_enabled` | Windows | `true` | 164.312(a)(2)(iii) |

## PCI DSS 4.0 {#pci-dss}

Profile **PCI-DSS Baseline**. The console labels this framework **PCI DSS**. Enforced: 87 floors across 33 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.cloud_protection_level` | Windows | `high` | 5.2.2 |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | 5.2.1 |
| `antimalware.pua_protection` | Windows | `true` | 5.2.2 |
| `antimalware.real_time_protection` | Windows | `true` | 5.2.1 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | 5.3.1 |
| `antimalware.tamper_protection` | Windows | `true` | 5.3.5 |
| `audit.linux_auditd_enabled` | Linux | `true` | 10.2.1.1 |
| `audit.logon_events` | Windows | `true` | 10.2.1.1 |
| `audit.policy_change` | Windows | `true` | 10.2.1.6 |
| `audit.process_creation_command_line` | Windows | `true` | 10.2.1.2 |
| `audit.security_log_max_bytes` | Windows | `201326592` | 10.3.2 |
| `browser.enforce_safe_browsing` | Windows | `true` | 5.4.1 |
| `compliance.endpoint_audit_retention_days` | Depot | `365` | 10.5.1 |
| `compliance.evidence_retention_days` | Depot | `365` | 12.4.2 |
| `device_activity.alert_on_driver_change` | All | `true` | 10.2.1.7 |
| `device_activity.alert_on_service_change` | All | `true` | 10.7.2 |
| `device_activity.alert_on_usb_storage` | All | `true` | 9.4 |
| `device_control.autorun_disabled` | Windows | `true` | 2.2.4 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | 3.5.1 |
| `device_control.usb_storage_policy` | Windows | `read_only` | 9.4.1 |
| `encryption.escrow_recovery_key` | All | `true` | 3.7.1 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | 3.5.1 |
| `encryption.macos_require_filevault` | macOS | `true` | 3.5.1 |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | 3.5.1 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | 3.5.1 |
| `firewall.allow_local_rule_merge` | Windows | `false` | 1.5.1 |
| `firewall.default_inbound_action` | Windows | `block` | 1.5.1 |
| `firewall.enabled_domain_profile` | Windows | `true` | 1.5.1 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | 1.5.1 |
| `firewall.enabled_public_profile` | Windows | `true` | 1.5.1 |
| `firewall.linux_enabled` | Linux | `true` | 1.5.1 |
| `firewall.macos_enabled` | macOS | `true` | 1.5.1 |
| `lockout.admin_lockout_enabled` | Windows | `true` | 8.3.4 |
| `lockout.duration_seconds` | Windows | `1800` | 8.3.4 |
| `lockout.linux_duration_seconds` | Linux | `1800` | 8.3.4 |
| `lockout.linux_reset_counter_seconds` | Linux | `900` | 8.3.4 |
| `lockout.linux_threshold_attempts` | Linux | `10` | 8.3.4 |
| `lockout.macos_duration_seconds` | macOS | `1800` | 8.3.4 |
| `lockout.macos_threshold_attempts` | macOS | `10` | 8.3.4 |
| `lockout.reset_counter_seconds` | Windows | `900` | 8.3.4 |
| `lockout.threshold_attempts` | Windows | `10` | 8.3.4 |
| `monitoring.agent_offline_alert_minutes` | All | `30` | 10.7.2 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | 10.2.1.5 |
| `monitoring.alert_on_service_stop` | All | `true` | 10.7.2 |
| `monitoring.collect_event_log_errors` | All | `true` | 10.2.1 |
| `monitoring.event_log_channels` | Windows | `System`, `Application`, `Security` | 10.2.1 |
| `monitoring.log_retention_days` | All | `365` | 10.5.1 |
| `monitoring.service_watchlist` | Windows, Linux | `WinDefend`, `mpssvc`, `EventLog` | 10.7.2 |
| `password.complexity_enabled` | Windows | `true` | 8.3.6 |
| `password.history_count` | Windows | `4` | 8.3.7 |
| `password.linux_max_age_days` | Linux | `90` | 8.3.9 |
| `password.linux_min_character_classes` | Linux | `3` | 8.3.6 |
| `password.linux_min_length` | Linux | `12` | 8.3.6 |
| `password.macos_history_count` | macOS | `4` | 8.3.7 |
| `password.macos_max_age_days` | macOS | `90` | 8.3.9 |
| `password.macos_min_character_classes` | macOS | `3` | 8.3.6 |
| `password.macos_min_length` | macOS | `12` | 8.3.6 |
| `password.max_age_days` | Windows | `90` | 8.3.9 |
| `password.min_length` | Windows, macOS | `12` | 8.3.6 |
| `password.require_digit` | Windows | `true` | 8.3.6 |
| `password.reversible_encryption` | Windows | `false` | 8.3.2 |
| `patch.auto_approve_critical` | All | `true` | 6.3.3 |
| `patch.auto_approve_security` | All | `true` | 6.3.3 |
| `patch.deferral_days_quality` | Windows | `30` | 6.3.3 |
| `patch.reboot_policy` | Windows | `notify_user` | 6.3.3 |
| `patch.third_party_patching_enabled` | All | `true` | 6.3.3 |
| `remote_access.clipboard_images` | All | `to_endpoint` | 3.4.2 |
| `remote_access.clipboard_text` | All | `to_endpoint` | 3.4.2 |
| `remote_access.file_transfer` | All | `to_endpoint` | 3.4.2 |
| `remote_access.idle_resume_requires_reauth` | All | `true` | 8.2.8 |
| `remote_access.tech_idle_pause_minutes` | All | `15` | 8.2.8 |
| `script_execution.log_script_output` | All | `true` | 10.2.1.2 |
| `script_execution.require_signed_scripts` | All | `true` | 6.5.1 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | 8.2.8 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | 8.2.8 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | 8.2.8 |
| `session.require_password_on_wake` | Windows, macOS | `true` | 8.2.8 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | 8.2.8 |
| `session.screensaver_enabled` | Windows | `true` | 8.2.8 |
| `software.allow_user_installs` | Windows | `false` | 2.2.4 |
| `software.installer_signature_required` | All | `true` | 6.5.1 |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | 7.2.2 |
| `uac.enabled` | Windows | `true` | 7.2.1 |
| `updates.automatic_security_updates` | Linux | `true` | 6.3.3 |
| `updates.macos_automatic_security_updates` | macOS | `true` | 6.3.3 |
| `vuln.alert_min_severity` | All | `high` | 6.3.1 |

## CJIS Security Policy {#cjis}

Profile **CJIS Baseline**. The console labels this framework **CJIS**. Enforced: 76 floors across 25 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | SI-3 |
| `antimalware.pua_protection` | Windows | `true` | SI-8 |
| `antimalware.real_time_protection` | Windows | `true` | SI-3 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | SI-3 |
| `antimalware.tamper_protection` | Windows | `true` | SI-3 |
| `audit.linux_auditd_enabled` | Linux | `true` | AU-2 |
| `audit.logon_events` | Windows | `true` | AU-2 |
| `audit.policy_change` | Windows | `true` | AU-2 |
| `audit.process_creation_command_line` | Windows | `true` | AU-3 |
| `audit.security_log_max_bytes` | Windows | `201326592` | AU-4 |
| `browser.enforce_safe_browsing` | Windows | `true` | SI-8 |
| `compliance.endpoint_audit_retention_days` | Depot | `365` | AU-11 |
| `credentials.local_admin.rotation_interval_days` | Windows | `30` | IA-5 |
| `device_activity.alert_on_driver_change` | All | `true` | AU-2 |
| `device_activity.alert_on_service_change` | All | `true` | SI-4 |
| `device_activity.alert_on_usb_storage` | All | `true` | SC-28 |
| `device_activity.enabled` | All | `true` | AU-2 |
| `device_control.autorun_disabled` | Windows | `true` | SI-3 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | MP-4 |
| `device_control.usb_storage_policy` | Windows | `read_only` | MP-7 |
| `encryption.escrow_recovery_key` | All | `true` | SC-12 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | SC-28 |
| `encryption.macos_require_filevault` | macOS | `true` | SC-28 |
| `encryption.os_drive_cipher` | Windows | `xts_aes_256` | SC-28(1) |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | SC-28(1) |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | SC-28 |
| `firewall.default_inbound_action` | Windows | `block` | SC-7(5) |
| `firewall.enabled_domain_profile` | Windows | `true` | SC-7 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | SC-7 |
| `firewall.enabled_public_profile` | Windows | `true` | SC-7 |
| `firewall.linux_enabled` | Linux | `true` | SC-7 |
| `firewall.macos_enabled` | macOS | `true` | SC-7 |
| `lockout.admin_lockout_enabled` | Windows | `true` | AC-7 |
| `lockout.duration_seconds` | Windows | `600` | AC-7 |
| `lockout.linux_duration_seconds` | Linux | `600` | AC-7 |
| `lockout.linux_threshold_attempts` | Linux | `5` | AC-7 |
| `lockout.macos_duration_seconds` | macOS | `600` | AC-7 |
| `lockout.macos_threshold_attempts` | macOS | `5` | AC-7 |
| `lockout.threshold_attempts` | Windows | `5` | AC-7 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | AC-2(4) |
| `monitoring.alert_on_service_stop` | All | `true` | AU-5 |
| `monitoring.collect_event_log_errors` | All | `true` | AU-2 |
| `monitoring.event_log_channels` | Windows | `System`, `Application`, `Security` | AU-2 |
| `monitoring.log_retention_days` | All | `365` | AU-11 |
| `passcode.required` | iOS, Android | `true` | AC-19 |
| `password.complexity_enabled` | Windows | `true` | IA-5(1) |
| `password.history_count` | Windows | `10` | IA-5(1) |
| `password.linux_max_age_days` | Linux | `90` | IA-5(1) |
| `password.linux_min_character_classes` | Linux | `3` | IA-5(1) |
| `password.linux_min_length` | Linux | `8` | IA-5 |
| `password.macos_history_count` | macOS | `10` | IA-5(1) |
| `password.macos_max_age_days` | macOS | `90` | IA-5(1) |
| `password.macos_min_character_classes` | macOS | `3` | IA-5(1) |
| `password.macos_min_length` | macOS | `8` | IA-5 |
| `password.max_age_days` | Windows | `90` | IA-5(1) |
| `password.min_length` | Windows, macOS | `8` | IA-5 |
| `patch.auto_approve_critical` | All | `true` | SI-2 |
| `patch.auto_approve_security` | All | `true` | SI-2 |
| `patch.deferral_days_quality` | Windows | `30` | SI-2 |
| `patch.reboot_policy` | Windows | `notify_user` | SI-2 |
| `remote_access.allowed_modes` | All | `attended`, `consent`, `escorted` | AC-17 |
| `remote_access.clipboard_images` | All | none | AC-17 |
| `remote_access.clipboard_text` | All | none | AC-17 |
| `remote_access.escort_quorum` | All | `2` | AC-3 |
| `remote_access.file_transfer` | All | none | AC-17 |
| `script_execution.log_script_output` | All | `true` | AU-2 |
| `script_execution.require_signed_scripts` | All | `true` | SI-10 |
| `session.disconnect_idle_rdp_seconds` | Windows | `1800` | AC-11 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `1800` | AC-11 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `1800` | AC-11 |
| `session.require_password_on_wake` | Windows, macOS | `true` | AC-11 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `1800` | AC-11 |
| `session.screensaver_enabled` | Windows | `true` | AC-11 |
| `uac.enabled` | Windows | `true` | AC-3 |
| `updates.automatic_security_updates` | Linux | `true` | SI-2 |
| `updates.macos_automatic_security_updates` | macOS | `true` | SI-2 |

## NIST SP 800-171 {#nist-800-171}

Profile **NIST 800-171 Baseline**. The console labels this framework **NIST SP 800-171**. Enforced: 77 floors across 28 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | 3.14.2 |
| `antimalware.pua_protection` | Windows | `true` | 3.14.2 |
| `antimalware.real_time_protection` | Windows | `true` | 3.14.2 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | 3.14.4 |
| `antimalware.tamper_protection` | Windows | `true` | 3.14.2 |
| `audit.linux_auditd_enabled` | Linux | `true` | 3.3.1 |
| `audit.logon_events` | Windows | `true` | 3.3.1 |
| `audit.policy_change` | Windows | `true` | 3.3.1 |
| `audit.process_creation_command_line` | Windows | `true` | 3.3.2 |
| `audit.security_log_max_bytes` | Windows | `201326592` | 3.3.1 |
| `compliance.endpoint_audit_retention_days` | Depot | `1095` | 3.3.1 |
| `device_activity.alert_on_driver_change` | All | `true` | 3.4.3 |
| `device_activity.alert_on_service_change` | All | `true` | 3.14.6 |
| `device_activity.alert_on_usb_storage` | All | `true` | 3.8.7 |
| `device_activity.enabled` | All | `true` | 3.3.1 |
| `device_control.autorun_disabled` | Windows | `true` | 3.4.6 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | 3.8.7 |
| `device_control.usb_storage_policy` | Windows | `read_only` | 3.8.7 |
| `encryption.escrow_recovery_key` | All | `true` | 3.13.10 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | 3.13.16 |
| `encryption.macos_require_filevault` | macOS | `true` | 3.13.16 |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | 3.13.16 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | 3.13.16 |
| `firewall.allow_local_rule_merge` | Windows | `false` | 3.4.2 |
| `firewall.default_inbound_action` | Windows | `block` | 3.13.6 |
| `firewall.enabled_domain_profile` | Windows | `true` | 3.13.1 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | 3.13.1 |
| `firewall.enabled_public_profile` | Windows | `true` | 3.13.1 |
| `firewall.linux_enabled` | Linux | `true` | 3.13.1 |
| `firewall.macos_enabled` | macOS | `true` | 3.13.1 |
| `lockout.admin_lockout_enabled` | Windows | `true` | 3.1.8 |
| `lockout.duration_seconds` | Windows | `900` | 3.1.8 |
| `lockout.linux_duration_seconds` | Linux | `900` | 3.1.8 |
| `lockout.linux_threshold_attempts` | Linux | `5` | 3.1.8 |
| `lockout.macos_duration_seconds` | macOS | `900` | 3.1.8 |
| `lockout.macos_threshold_attempts` | macOS | `5` | 3.1.8 |
| `lockout.threshold_attempts` | Windows | `5` | 3.1.8 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | 3.5.5 |
| `monitoring.alert_on_service_stop` | All | `true` | 3.14.6 |
| `monitoring.log_retention_days` | All | `1095` | 3.3.1 |
| `passcode.required` | iOS, Android | `true` | 3.1.18 |
| `password.complexity_enabled` | Windows | `true` | 3.5.7 |
| `password.history_count` | Windows | `24` | 3.5.8 |
| `password.linux_max_age_days` | Linux | `90` | 3.5.6 |
| `password.linux_min_character_classes` | Linux | `3` | 3.5.7 |
| `password.linux_min_length` | Linux | `12` | 3.5.7 |
| `password.macos_history_count` | macOS | `24` | 3.5.8 |
| `password.macos_max_age_days` | macOS | `90` | 3.5.6 |
| `password.macos_min_character_classes` | macOS | `3` | 3.5.7 |
| `password.macos_min_length` | macOS | `12` | 3.5.7 |
| `password.max_age_days` | Windows | `90` | 3.5.6 |
| `password.min_length` | Windows, macOS | `12` | 3.5.7 |
| `password.reversible_encryption` | Windows | `false` | 3.5.10 |
| `patch.auto_approve_critical` | All | `true` | 3.14.1 |
| `patch.auto_approve_security` | All | `true` | 3.14.1 |
| `patch.deferral_days_quality` | Windows | `30` | 3.14.1 |
| `patch.reboot_policy` | Windows | `notify_user` | 3.14.1 |
| `remote_access.allowed_modes` | All | `attended`, `consent`, `escorted` | 3.1.12 |
| `remote_access.file_transfer` | All | `to_endpoint` | 3.1.12 |
| `script_execution.log_script_output` | All | `true` | 3.3.2 |
| `script_execution.powershell_execution_policy` | Windows | `all_signed` | 3.4.8 |
| `script_execution.require_signed_scripts` | All | `true` | 3.4.8 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | 3.1.11 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | 3.1.10 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | 3.1.10 |
| `session.require_password_on_wake` | Windows, macOS | `true` | 3.1.10 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | 3.1.10 |
| `session.screensaver_enabled` | Windows | `true` | 3.1.10 |
| `software.allow_user_installs` | Windows | `false` | 3.4.9 |
| `software.installer_signature_required` | All | `true` | 3.4.8 |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | 3.1.5 |
| `uac.detect_application_installs` | Windows | `true` | 3.4.9 |
| `uac.enabled` | Windows | `true` | 3.1.5 |
| `uac.standard_user_elevation` | Windows | `automatically_deny` | 3.1.7 |
| `updates.automatic_security_updates` | Linux | `true` | 3.14.1 |
| `updates.macos_automatic_security_updates` | macOS | `true` | 3.14.1 |
| `vuln.alert_min_severity` | All | `high` | 3.11.3 |

## NIST SP 800-53 Rev 5 {#nist-800-53}

Profile **NIST 800-53 Baseline**. The console labels this framework **NIST SP 800-53**. Enforced: 83 floors across 30 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.cloud_protection_level` | Windows | `high` | SI-3 |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | SI-3 |
| `antimalware.pua_protection` | Windows | `true` | SI-3 |
| `antimalware.real_time_protection` | Windows | `true` | SI-3 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | SI-3 |
| `antimalware.tamper_protection` | Windows | `true` | SI-3 |
| `audit.linux_auditd_enabled` | Linux | `true` | AU-2 |
| `audit.logon_events` | Windows | `true` | AU-2 |
| `audit.policy_change` | Windows | `true` | AU-2 |
| `audit.process_creation_command_line` | Windows | `true` | AU-3 |
| `audit.security_log_max_bytes` | Windows | `201326592` | AU-4 |
| `browser.enforce_safe_browsing` | Windows | `true` | SI-3 |
| `compliance.endpoint_audit_retention_days` | Depot | `1095` | AU-11 |
| `device_activity.alert_on_driver_change` | All | `true` | CM-6 |
| `device_activity.alert_on_service_change` | All | `true` | CM-6 |
| `device_activity.alert_on_usb_storage` | All | `true` | MP-7 |
| `device_activity.enabled` | All | `true` | AU-2 |
| `device_control.autorun_disabled` | Windows | `true` | CM-7 |
| `device_control.block_bluetooth_file_transfer` | Windows | `true` | CM-7 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | MP-7 |
| `device_control.usb_storage_policy` | Windows | `read_only` | MP-7 |
| `encryption.escrow_recovery_key` | All | `true` | SC-12 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | SC-28(1) |
| `encryption.macos_require_filevault` | macOS | `true` | SC-28(1) |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | SC-28(1) |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | SC-28(1) |
| `firewall.allow_local_rule_merge` | Windows | `false` | CM-6 |
| `firewall.default_inbound_action` | Windows | `block` | SC-7(5) |
| `firewall.enabled_domain_profile` | Windows | `true` | SC-7 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | SC-7 |
| `firewall.enabled_public_profile` | Windows | `true` | SC-7 |
| `firewall.linux_enabled` | Linux | `true` | SC-7 |
| `firewall.macos_enabled` | macOS | `true` | SC-7 |
| `lockout.admin_lockout_enabled` | Windows | `true` | AC-7 |
| `lockout.duration_seconds` | Windows | `900` | AC-7 |
| `lockout.linux_duration_seconds` | Linux | `900` | AC-7 |
| `lockout.linux_threshold_attempts` | Linux | `5` | AC-7 |
| `lockout.macos_duration_seconds` | macOS | `900` | AC-7 |
| `lockout.macos_threshold_attempts` | macOS | `5` | AC-7 |
| `lockout.threshold_attempts` | Windows | `5` | AC-7 |
| `monitoring.agent_offline_alert_minutes` | All | `30` | SI-4 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | AC-2(4) |
| `monitoring.alert_on_service_stop` | All | `true` | SI-4 |
| `monitoring.collect_event_log_errors` | All | `true` | AU-6 |
| `monitoring.event_log_channels` | Windows | `System`, `Application`, `Security` | AU-2 |
| `monitoring.log_retention_days` | All | `1095` | AU-11 |
| `passcode.required` | iOS, Android | `true` | AC-19 |
| `password.complexity_enabled` | Windows | `true` | IA-5(1) |
| `password.history_count` | Windows | `24` | IA-5(1) |
| `password.linux_max_age_days` | Linux | `90` | IA-5(1) |
| `password.linux_min_character_classes` | Linux | `3` | IA-5(1) |
| `password.linux_min_length` | Linux | `12` | IA-5(1) |
| `password.macos_history_count` | macOS | `24` | IA-5(1) |
| `password.macos_max_age_days` | macOS | `90` | IA-5(1) |
| `password.macos_min_character_classes` | macOS | `3` | IA-5(1) |
| `password.macos_min_length` | macOS | `12` | IA-5(1) |
| `password.max_age_days` | Windows | `90` | IA-5(1) |
| `password.min_length` | Windows, macOS | `12` | IA-5(1) |
| `password.reversible_encryption` | Windows | `false` | IA-5(1) |
| `patch.auto_approve_critical` | All | `true` | SI-2 |
| `patch.auto_approve_security` | All | `true` | SI-2 |
| `patch.deferral_days_quality` | Windows | `30` | SI-2 |
| `patch.reboot_policy` | Windows | `notify_user` | SI-2 |
| `remote_access.allowed_modes` | All | `attended`, `consent`, `escorted` | AC-17 |
| `remote_access.file_transfer` | All | `to_endpoint` | AC-17 |
| `script_execution.log_script_output` | All | `true` | AC-6(9) |
| `script_execution.powershell_execution_policy` | Windows | `all_signed` | CM-7(2) |
| `script_execution.require_signed_scripts` | All | `true` | CM-14 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | AC-12 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | AC-11 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | AC-11 |
| `session.require_password_on_wake` | Windows, macOS | `true` | AC-11 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | AC-11 |
| `session.screensaver_enabled` | Windows | `true` | AC-11(1) |
| `software.allow_user_installs` | Windows | `false` | CM-11 |
| `software.installer_signature_required` | All | `true` | CM-14 |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | AC-6 |
| `uac.detect_application_installs` | Windows | `true` | CM-11 |
| `uac.enabled` | Windows | `true` | AC-6 |
| `uac.standard_user_elevation` | Windows | `automatically_deny` | AC-6(10) |
| `updates.automatic_security_updates` | Linux | `true` | SI-2 |
| `updates.macos_automatic_security_updates` | macOS | `true` | SI-2 |
| `vuln.alert_min_severity` | All | `high` | RA-5 |

## CMMC Level 2 {#cmmc-level-2}

Profile **CMMC Level 2 Baseline**. The console labels this framework **CMMC Level 2**. Enforced: 73 floors across 27 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | SI.L1-3.14.2 |
| `antimalware.pua_protection` | Windows | `true` | SI.L1-3.14.2 |
| `antimalware.real_time_protection` | Windows | `true` | SI.L1-3.14.2 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | SI.L1-3.14.4 |
| `antimalware.tamper_protection` | Windows | `true` | SI.L1-3.14.2 |
| `audit.linux_auditd_enabled` | Linux | `true` | AU.L2-3.3.1 |
| `audit.logon_events` | Windows | `true` | AU.L2-3.3.1 |
| `audit.policy_change` | Windows | `true` | AU.L2-3.3.1 |
| `audit.process_creation_command_line` | Windows | `true` | AU.L2-3.3.2 |
| `audit.security_log_max_bytes` | Windows | `201326592` | AU.L2-3.3.1 |
| `compliance.endpoint_audit_retention_days` | Depot | `1095` | AU.L2-3.3.1 |
| `device_control.autorun_disabled` | Windows | `true` | CM.L2-3.4.6 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | MP.L2-3.8.7 |
| `device_control.usb_storage_policy` | Windows | `read_only` | MP.L2-3.8.7 |
| `encryption.escrow_recovery_key` | All | `true` | SC.L2-3.13.10 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | SC.L2-3.13.16 |
| `encryption.macos_require_filevault` | macOS | `true` | SC.L2-3.13.16 |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | SC.L2-3.13.16 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | SC.L2-3.13.16 |
| `firewall.allow_local_rule_merge` | Windows | `false` | CM.L2-3.4.2 |
| `firewall.default_inbound_action` | Windows | `block` | SC.L2-3.13.6 |
| `firewall.enabled_domain_profile` | Windows | `true` | SC.L1-3.13.1 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | SC.L1-3.13.1 |
| `firewall.enabled_public_profile` | Windows | `true` | SC.L1-3.13.1 |
| `firewall.linux_enabled` | Linux | `true` | SC.L1-3.13.1 |
| `firewall.macos_enabled` | macOS | `true` | SC.L1-3.13.1 |
| `lockout.admin_lockout_enabled` | Windows | `true` | AC.L2-3.1.8 |
| `lockout.duration_seconds` | Windows | `900` | AC.L2-3.1.8 |
| `lockout.linux_duration_seconds` | Linux | `900` | AC.L2-3.1.8 |
| `lockout.linux_threshold_attempts` | Linux | `5` | AC.L2-3.1.8 |
| `lockout.macos_duration_seconds` | macOS | `900` | AC.L2-3.1.8 |
| `lockout.macos_threshold_attempts` | macOS | `5` | AC.L2-3.1.8 |
| `lockout.threshold_attempts` | Windows | `5` | AC.L2-3.1.8 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | IA.L2-3.5.5 |
| `monitoring.alert_on_service_stop` | All | `true` | SI.L2-3.14.6 |
| `monitoring.log_retention_days` | All | `1095` | AU.L2-3.3.1 |
| `password.complexity_enabled` | Windows | `true` | IA.L2-3.5.7 |
| `password.history_count` | Windows | `24` | IA.L2-3.5.8 |
| `password.linux_max_age_days` | Linux | `90` | IA.L2-3.5.6 |
| `password.linux_min_character_classes` | Linux | `3` | IA.L2-3.5.7 |
| `password.linux_min_length` | Linux | `12` | IA.L2-3.5.7 |
| `password.macos_history_count` | macOS | `24` | IA.L2-3.5.8 |
| `password.macos_max_age_days` | macOS | `90` | IA.L2-3.5.6 |
| `password.macos_min_character_classes` | macOS | `3` | IA.L2-3.5.7 |
| `password.macos_min_length` | macOS | `12` | IA.L2-3.5.7 |
| `password.max_age_days` | Windows | `90` | IA.L2-3.5.6 |
| `password.min_length` | Windows, macOS | `12` | IA.L2-3.5.7 |
| `password.reversible_encryption` | Windows | `false` | IA.L2-3.5.10 |
| `patch.auto_approve_critical` | All | `true` | SI.L1-3.14.1 |
| `patch.auto_approve_security` | All | `true` | SI.L1-3.14.1 |
| `patch.deferral_days_quality` | Windows | `30` | SI.L1-3.14.1 |
| `patch.reboot_policy` | Windows | `notify_user` | SI.L1-3.14.1 |
| `remote_access.allowed_modes` | All | `attended`, `consent`, `escorted` | AC.L2-3.1.12 |
| `remote_access.file_transfer` | All | `to_endpoint` | AC.L2-3.1.12 |
| `script_execution.log_script_output` | All | `true` | AU.L2-3.3.2 |
| `script_execution.powershell_execution_policy` | Windows | `all_signed` | CM.L2-3.4.8 |
| `script_execution.require_signed_scripts` | All | `true` | CM.L2-3.4.8 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | AC.L2-3.1.11 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | AC.L2-3.1.10 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | AC.L2-3.1.10 |
| `session.require_password_on_wake` | Windows, macOS | `true` | AC.L2-3.1.10 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | AC.L2-3.1.10 |
| `session.screensaver_enabled` | Windows | `true` | AC.L2-3.1.10 |
| `software.allow_user_installs` | Windows | `false` | CM.L2-3.4.9 |
| `software.installer_signature_required` | All | `true` | CM.L2-3.4.8 |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | AC.L2-3.1.5 |
| `uac.detect_application_installs` | Windows | `true` | CM.L2-3.4.9 |
| `uac.enabled` | Windows | `true` | AC.L2-3.1.5 |
| `uac.standard_user_elevation` | Windows | `automatically_deny` | AC.L2-3.1.7 |
| `updates.automatic_security_updates` | Linux | `true` | SI.L1-3.14.1 |
| `updates.macos_automatic_security_updates` | macOS | `true` | SI.L1-3.14.1 |
| `vuln.alert_min_severity` | All | `high` | RA.L2-3.11.3 |

## ISO/IEC 27001 {#iso-27001}

Profile **ISO 27001 Baseline**. The console labels this framework **ISO/IEC 27001**. Enforced: 72 floors across 16 cited controls.

| Setting | Platforms | Floor | Control |
| --- | --- | --- | --- |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | A.8.7 |
| `antimalware.pua_protection` | Windows | `true` | A.8.7 |
| `antimalware.real_time_protection` | Windows | `true` | A.8.7 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | A.8.7 |
| `antimalware.tamper_protection` | Windows | `true` | A.8.7 |
| `audit.linux_auditd_enabled` | Linux | `true` | A.8.15 |
| `audit.logon_events` | Windows | `true` | A.8.15 |
| `audit.policy_change` | Windows | `true` | A.8.15 |
| `audit.process_creation_command_line` | Windows | `true` | A.8.15 |
| `audit.security_log_max_bytes` | Windows | `201326592` | A.8.15 |
| `compliance.endpoint_audit_retention_days` | Depot | `365` | A.5.33 |
| `compliance.evidence_retention_days` | Depot | `365` | A.5.33 |
| `device_activity.alert_on_usb_storage` | All | `true` | A.7.10 |
| `device_control.autorun_disabled` | Windows | `true` | A.8.7 |
| `device_control.usb_storage_encryption_required` | Windows | `true` | A.7.10 |
| `device_control.usb_storage_policy` | Windows | `read_only` | A.7.10 |
| `encryption.escrow_recovery_key` | All | `true` | A.8.24 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | A.8.24 |
| `encryption.macos_require_filevault` | macOS | `true` | A.8.24 |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | A.8.24 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | A.8.24 |
| `firewall.default_inbound_action` | Windows | `block` | A.8.20 |
| `firewall.enabled_domain_profile` | Windows | `true` | A.8.20 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | A.8.20 |
| `firewall.enabled_public_profile` | Windows | `true` | A.8.20 |
| `firewall.linux_enabled` | Linux | `true` | A.8.20 |
| `firewall.macos_enabled` | macOS | `true` | A.8.20 |
| `lockout.admin_lockout_enabled` | Windows | `true` | A.8.5 |
| `lockout.duration_seconds` | Windows | `900` | A.8.5 |
| `lockout.linux_duration_seconds` | Linux | `900` | A.8.5 |
| `lockout.linux_threshold_attempts` | Linux | `10` | A.8.5 |
| `lockout.macos_duration_seconds` | macOS | `900` | A.8.5 |
| `lockout.macos_threshold_attempts` | macOS | `10` | A.8.5 |
| `lockout.threshold_attempts` | Windows | `10` | A.8.5 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | A.8.16 |
| `monitoring.alert_on_service_stop` | All | `true` | A.8.16 |
| `monitoring.log_retention_days` | All | `365` | A.8.15 |
| `password.complexity_enabled` | Windows | `true` | A.5.17 |
| `password.history_count` | Windows | `24` | A.5.17 |
| `password.linux_max_age_days` | Linux | `90` | A.5.17 |
| `password.linux_min_character_classes` | Linux | `3` | A.5.17 |
| `password.linux_min_length` | Linux | `12` | A.5.17 |
| `password.macos_history_count` | macOS | `24` | A.5.17 |
| `password.macos_max_age_days` | macOS | `90` | A.5.17 |
| `password.macos_min_character_classes` | macOS | `3` | A.5.17 |
| `password.macos_min_length` | macOS | `12` | A.5.17 |
| `password.max_age_days` | Windows | `90` | A.5.17 |
| `password.min_length` | Windows, macOS | `12` | A.5.17 |
| `password.reversible_encryption` | Windows | `false` | A.5.17 |
| `patch.auto_approve_critical` | All | `true` | A.8.8 |
| `patch.auto_approve_security` | All | `true` | A.8.8 |
| `patch.deferral_days_quality` | Windows | `30` | A.8.8 |
| `patch.reboot_policy` | Windows | `notify_user` | A.8.8 |
| `remote_access.clipboard_images` | All | `to_endpoint` | A.8.12 |
| `remote_access.clipboard_text` | All | `to_endpoint` | A.8.12 |
| `remote_access.file_transfer` | All | `to_endpoint` | A.8.12 |
| `script_execution.log_script_output` | All | `true` | A.8.15 |
| `script_execution.require_signed_scripts` | All | `true` | A.8.18 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | A.5.15 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | A.7.7 |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | A.7.7 |
| `session.require_password_on_wake` | Windows, macOS | `true` | A.7.7 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | A.7.7 |
| `session.screensaver_enabled` | Windows | `true` | A.7.7 |
| `software.allow_user_installs` | Windows | `false` | A.8.19 |
| `software.installer_signature_required` | All | `true` | A.8.19 |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | A.8.2 |
| `uac.detect_application_installs` | Windows | `true` | A.8.19 |
| `uac.enabled` | Windows | `true` | A.8.2 |
| `updates.automatic_security_updates` | Linux | `true` | A.8.8 |
| `updates.macos_automatic_security_updates` | macOS | `true` | A.8.8 |

## DISA STIG {#disa-stig}

Profile **DISA STIG Hardening**. The console labels this framework **STIG**. Advisory: 87 recommended values across 63 cited controls. None of them is a floor.

| Setting | Platforms | Recommended value | Control |
| --- | --- | --- | --- |
| `antimalware.cloud_protection_level` | Windows | `high` | WNDF-AV-000010 |
| `antimalware.excluded_paths` | Windows | none | WNDF-AV-000005 |
| `antimalware.macos_gatekeeper_enabled` | macOS | `true` | Apple macOS STIG |
| `antimalware.pua_protection` | Windows | `true` | WNDF-AV-000001 |
| `antimalware.real_time_protection` | Windows | `true` | WNDF-AV-000021 |
| `antimalware.signature_update_interval_seconds` | Windows | `86400` | WNDF-AV-000030 |
| `audit.linux_auditd_enabled` | Linux | `true` | RHEL 9 STIG, auditd active |
| `audit.logon_events` | Windows | `true` | WN11-AU-000070 |
| `audit.policy_change` | Windows | `true` | WN11-AU-000100 |
| `audit.process_creation_command_line` | Windows | `true` | WN11-CC-000066 |
| `audit.security_log_max_bytes` | Windows | `1048576` | WN11-AU-000500 |
| `browser.block_password_manager` | Windows | `true` | EDGE-00-000043 |
| `browser.enforce_safe_browsing` | Windows | `true` | EDGE-00-000050 |
| `browser.extension_install_blocklist` | Windows | `*` | EDGE-00-000041 |
| `browser.incognito_mode_availability` | Windows | `disabled` | EDGE-00-000005 |
| `device_activity.alert_on_driver_change` | All | `true` | WN11-CC-000000 |
| `device_activity.alert_on_service_change` | All | `true` | WN11-00-000000 |
| `device_activity.alert_on_usb_storage` | All | `true` | WN11-00-000000 |
| `device_activity.enabled` | All | `true` | WN11-AU-000000 |
| `device_control.autorun_disabled` | Windows | `true` | WN11-CC-000185 |
| `device_control.block_bluetooth_file_transfer` | Windows | `true` | WN11-00-000210 |
| `discovery.snmp_enabled` | All | `false` | WN11-00-000105 |
| `encryption.linux_require_disk_encryption` | Linux | `true` | RHEL 9 STIG, LUKS data at rest |
| `encryption.macos_require_filevault` | macOS | `true` | Apple macOS STIG |
| `encryption.require_fixed_drive_encryption` | Windows | `true` | WN11-00-000030 |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | WN11-00-000030 |
| `encryption.require_pre_boot_authentication` | Windows | `true` | WN11-00-000031 |
| `firewall.allow_local_rule_merge` | Windows | `false` | WNFWA-000024 |
| `firewall.default_inbound_action` | Windows | `block` | WN11-FW-000010 |
| `firewall.default_outbound_action` | Windows | `allow` | WNFWA-000005 |
| `firewall.enabled_domain_profile` | Windows | `true` | WNFWA-000001 |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | WNFWA-000002 |
| `firewall.enabled_public_profile` | Windows | `true` | WNFWA-000003 |
| `firewall.linux_enabled` | Linux | `true` | RHEL 9 STIG, firewalld active |
| `firewall.macos_enabled` | macOS | `true` | Apple macOS STIG |
| `firewall.macos_stealth_mode` | macOS | `true` | Apple macOS STIG |
| `lockout.admin_lockout_enabled` | Windows | `true` | WN11-AC-000010 |
| `lockout.duration_seconds` | Windows | `900` | WN11-AC-000005 |
| `lockout.linux_reset_counter_seconds` | Linux | `900` | RHEL 9 STIG, faillock fail_interval |
| `lockout.linux_threshold_attempts` | Linux | `3` | RHEL 9 STIG, faillock deny |
| `lockout.macos_duration_seconds` | macOS | `900` | Apple macOS STIG |
| `lockout.macos_threshold_attempts` | macOS | `3` | Apple macOS STIG |
| `lockout.reset_counter_seconds` | Windows | `900` | WN11-AC-000015 |
| `lockout.threshold_attempts` | Windows | `3` | WN11-AC-000010 |
| `monitoring.alert_on_new_admin_account` | Windows | `true` | WN11-AU-000040 |
| `password.complexity_enabled` | Windows | `true` | WN11-AC-000040 |
| `password.history_count` | Windows | `24` | WN11-AC-000025 |
| `password.linux_max_age_days` | Linux | `60` | RHEL 9 STIG, PASS_MAX_DAYS |
| `password.linux_min_age_days` | Linux | `1` | RHEL 9 STIG, PASS_MIN_DAYS |
| `password.linux_min_character_classes` | Linux | `4` | RHEL 9 STIG, pwquality minclass |
| `password.linux_min_length` | Linux | `15` | RHEL 9 STIG, pwquality minlen |
| `password.macos_history_count` | macOS | `5` | Apple macOS STIG |
| `password.macos_max_age_days` | macOS | `60` | Apple macOS STIG |
| `password.macos_min_character_classes` | macOS | `4` | Apple macOS STIG |
| `password.macos_min_length` | macOS | `15` | Apple macOS STIG |
| `password.max_age_days` | Windows | `60` | WN11-AC-000025 |
| `password.min_length` | Windows, macOS | `14` | WN11-AC-000035 |
| `password.reversible_encryption` | Windows | `false` | WN11-AC-000045 |
| `patch.auto_approve_critical` | All | `true` | WN11-00-000040 |
| `patch.auto_approve_security` | All | `true` | WN11-00-000040 |
| `patch.deferral_days_quality` | Windows | `30` | WN11-00-000040 |
| `power.require_password_on_resume` | Windows | `true` | WN11-CC-000145 |
| `remote_access.clipboard_images` | All | `to_endpoint` | WN11-CC-000275 |
| `remote_access.clipboard_text` | All | `to_endpoint` | WN11-CC-000275 |
| `remote_access.file_transfer` | All | `to_endpoint` | WN11-CC-000275 |
| `script_execution.log_script_output` | All | `true` | WN11-CC-000327 |
| `script_execution.powershell_execution_policy` | Windows | `all_signed` | WN11-CC-000326 |
| `session.disconnect_idle_rdp_seconds` | Windows | `900` | WN11-CC-000280 |
| `session.hide_last_signed_in_user` | Windows | `true` | WN11-SO-000075 |
| `session.legal_notice_caption` | Windows | `DoD Notice and Consent Banner` | WN11-SO-000080 |
| `session.legal_notice_text` | Windows | The notice text the control cites | WN11-SO-000075 |
| `session.linux_screen_lock_timeout_seconds` | Linux | `900` | RHEL 9 STIG, GNOME idle-delay |
| `session.macos_guest_account_disabled` | macOS | `true` | Apple macOS STIG |
| `session.macos_screen_lock_timeout_seconds` | macOS | `900` | Apple macOS STIG |
| `session.require_password_on_wake` | Windows, macOS | `true` | WN11-SO-000070 |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | WN11-SO-000070 |
| `session.screensaver_enabled` | Windows | `true` | WN11-SO-000070 |
| `software.allow_user_installs` | Windows | `false` | WN11-CC-000315 |
| `ssh.macos_remote_login` | macOS | `off` | Apple macOS STIG |
| `ssh.permit_root_login` | Linux | `no` | RHEL 9 STIG, PermitRootLogin |
| `ssh.x11_forwarding` | Linux | `no` | RHEL 9 STIG, X11Forwarding |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | WN11-SO-000250 |
| `uac.detect_application_installs` | Windows | `true` | WN11-SO-000260 |
| `uac.enabled` | Windows | `true` | WN11-SO-000245 |
| `uac.standard_user_elevation` | Windows | `automatically_deny` | WN11-SO-000255 |
| `updates.automatic_security_updates` | Linux | `true` | RHEL 9 STIG, security patching |
| `updates.macos_automatic_security_updates` | macOS | `true` | Apple macOS STIG |

## Microsoft security baseline {#microsoft-security-baseline}

Profile **Microsoft Security Baseline**. The console labels this framework **Microsoft baseline**. Advisory: 40 recommended values across 6 cited controls. None of them is a floor.

| Setting | Platforms | Recommended value | Control |
| --- | --- | --- | --- |
| `antimalware.cloud_protection_level` | Windows | `high` | Windows 11 24H2 Security Baseline |
| `antimalware.pua_protection` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `antimalware.real_time_protection` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `audit.logon_events` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `audit.policy_change` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `audit.process_creation_command_line` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `audit.security_log_max_bytes` | Windows | `201326592` | Windows 11 24H2 Security Baseline |
| `browser.enforce_safe_browsing` | Windows | `true` | Microsoft Edge v139 Security Baseline |
| `browser.extension_install_blocklist` | Windows | `*` | Microsoft Edge v139 Security Baseline |
| `device_activity.alert_on_driver_change` | All | `true` | Device Installation |
| `device_activity.alert_on_service_change` | All | `true` | Windows Defender Antivirus |
| `device_activity.alert_on_usb_storage` | All | `true` | Removable Storage Access |
| `device_control.autorun_disabled` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `device_control.usb_storage_encryption_required` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `encryption.os_drive_cipher` | Windows | `xts_aes_256` | Windows 11 24H2 Security Baseline (BitLocker) |
| `encryption.require_os_drive_encryption` | Windows, macOS | `true` | Windows 11 24H2 Security Baseline (BitLocker) |
| `firewall.allow_local_rule_merge` | Windows | `false` | Windows 11 24H2 Security Baseline |
| `firewall.default_inbound_action` | Windows | `block` | Windows 11 24H2 Security Baseline |
| `firewall.default_outbound_action` | Windows | `allow` | Windows 11 24H2 Security Baseline |
| `firewall.enabled_domain_profile` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `firewall.enabled_private_profile` | Windows, macOS | `true` | Windows 11 24H2 Security Baseline |
| `firewall.enabled_public_profile` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `lockout.admin_lockout_enabled` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `lockout.duration_seconds` | Windows | `600` | Windows 11 24H2 Security Baseline |
| `lockout.reset_counter_seconds` | Windows | `600` | Windows 11 24H2 Security Baseline |
| `lockout.threshold_attempts` | Windows | `10` | Windows 11 24H2 Security Baseline |
| `password.complexity_enabled` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `password.history_count` | Windows | `24` | Windows 11 24H2 Security Baseline |
| `password.min_length` | Windows, macOS | `14` | Windows 11 24H2 Security Baseline |
| `password.reversible_encryption` | Windows | `false` | Windows 11 24H2 Security Baseline |
| `power.require_password_on_resume` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `remote_access.clipboard_images` | All | `to_endpoint` | Windows 11 24H2 Security Baseline |
| `remote_access.clipboard_text` | All | `to_endpoint` | Windows 11 24H2 Security Baseline |
| `remote_access.file_transfer` | All | `to_endpoint` | Windows 11 24H2 Security Baseline |
| `script_execution.log_script_output` | All | `true` | Windows 11 24H2 Security Baseline |
| `session.screen_lock_timeout_seconds` | Windows, macOS | `900` | Windows 11 24H2 Security Baseline |
| `uac.admin_approval_prompt` | Windows | `prompt_for_consent_secure_desktop` | Windows 11 24H2 Security Baseline |
| `uac.detect_application_installs` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `uac.enabled` | Windows | `true` | Windows 11 24H2 Security Baseline |
| `uac.standard_user_elevation` | Windows | `automatically_deny` | Windows 11 24H2 Security Baseline |

## Related

- [Compliance framework baselines](/compliance/framework-baselines/)
- [Review compliance posture](/compliance/compliance-overview/)
- [Request and approve exceptions](/compliance/exceptions/)