The macOS system must disable the TouchID System Settings pane.

STIG ID: APPL-14-002051 |  SRG: SRG-OS-000095-GPOS-00049 |  Severity: medium |  CCI:  | Vulnerability Id: V-259506

Vulnerability Discussion

The System Settings pane for TouchID must be disabled.

Disabling the System Settings pane prevents the users from configuring TouchID.

Check

Configure the macOS system to disable the TouchID System Settings pane
by installing the "com.apple.systempreferences" configuration profile.

Fix

Verify the macOS system is configured to disable the TouchID System Settings pane with
the following command:

/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath
'//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c
"com.apple.Touch-ID-Settings.extension"

If the result is not "1", this is a finding.