Disable Bluetooth Sharing is not enforced in CIS level 1 on macOS Tahoe

[macchrister]

Im enforcing CIS level 1 in Jamf

(Summarize the bug encountered concisely)

Steps to reproduce

Enforcing CIS level 1

Operating System version

macOS 26.x

Intel or Apple Silicon

Apple Silicon Mac

What is the current bug behavior?

No config is settings for Disable Bluetooth Sharing

What is the expected correct behavior?

That Bluetooth Sharing is disabled

[jmahlman]

The rule for CIS 2.3.3.10: Ensure Bluetooth Sharing Is Disabled exists in the benchmark file

And the rule itself exists in the system_settings rules.

Are you saying there is another rule missing? If so, which CIS number are you referring?

[macchrister]

Hi Yes the rule exists but it is not enforced. When I look in “Rule Report” or Benchmark overview its Faild. Im then looked in the Auditing document and made a policy that disabled bluetooth sharing and that woked so I don’t belive that when I enforceing cis level1 "2.3.3.10: Ensure Bluetooth Sharing Is Disable” is not configured to disable bluetooth sharing. Regards Christer From: John Mahlman ***@***.***> Date: Thursday, 12 February 2026 at 17:06 To: usnistgov/macos_security ***@***.***> Cc: Christer Grafström ***@***.***>, Author ***@***.***> Subject: Re: [usnistgov/macos_security] Disable Bluetooth Sharing is not enforced in CIS level 1 on macOS Tahoe (Issue #631) [https://avatars.githubusercontent.com/u/6446802?s=20&v=4]jmahlman left a comment (usnistgov/macos_security#631)<#631 (comment)> The rule for CIS 2.3.3.10: Ensure Bluetooth Sharing Is Disabled exists in the benchmark file<https://github.com/usnistgov/macos_security/blob/tahoe/baselines/cis_lvl1.yaml#L80> And the rule itself exists in the system_settings rules<https://github.com/usnistgov/macos_security/blob/tahoe/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml>. Are you saying there is another rule missing? If so, which CIS number are you referring? — Reply to this email directly, view it on GitHub<#631 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACD4QWA24WTSQITOWJX4YXL4LSQHTAVCNFSM6AAAAACU4QTY3OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQOJRHAZDMNJYG4>. You are receiving this because you authored the thread.