The OS X system must be configured so that users do not have Apple IDs signed into iCloud.

From Apple OS X 10.12 Security Technical Implementation Guide

Associated with: CCI-000366

SV-90817r1_rule The OS X system must be configured so that users do not have Apple IDs signed into iCloud.

Vulnerability discussion

Users should not sign into iCloud, as this leads to the possibility that sensitive data could be saved to iCloud storage or that users could inadvertently introduce viruses or malware previously saved to iCloud from other systems.

Check content

To see if any user account has configured an Apple ID for iCloud usage, run the following command: /usr/bin/sudo find /Users/ -name 'MobileMeAccounts.plist' -exec /usr/bin/defaults read '{}' \; If the results show any accounts listed, this is a finding.

Fix text

This must be resolved manually. With the affected user logged on, open System Preferences >> iCloud. Choose "Sign Out".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.