Smart card authentication must be enforced. The use of smart card credentials facilitates standardization and reduces the risk of unauthorized access. When enforceSmartCard is set to "true", the smart card must be used for logon, authorization, and unlocking the screensaver. CAUTION:enforceSmartCard will apply to the whole system. No users will be able to log on with their password unless the profile is removed or a user is exempt from smart card enforcement. Note:enforceSmartcard requires allowSmartcard to be set to true in order to work. Audit: Verify the macOS system is configured to enforce multifactor authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('enforceSmartCard').js EOS If the result is not "true", this is a finding. Remediation: Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile with 'enforceSmartCard' key set to true

[Yes/No]

Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile with 'enforceSmartCard' key set to true