The Target of Evaluation (TOE) is Apple macOS 15 Sequoia, which is a general purpose operating system running on the Apple Mac computers with Apple silicon.
\r\nThe TOE is a Unix-based operating system built on top of the XNU kernel. The TOE implements standard Unix facilities, provides both command-line and graphical user interfaces, supports Bluetooth communication, and includes Wireless Local Area Network (WLAN) client functionality. A portion of the Bluetooth and WLAN functionalities is implemented in hardware.
\r\nThe Mac computers covered in this evaluation contain the Secure Enclave, a dedicated secure subsystem integrated into the Apple silicon. Utilizing a dedicated processor (Secure Enclave Processor or SEP), the Secure Enclave is isolated from the main processor to provide an extra layer of security designed to keep sensitive data secure. The SEP executes the SEP Operating System (sepOS), which is based on a customized version of the L4 microkernel. The sepOS is included with macOS and is within the TOE boundary. The Secure Enclave supports the TOE for secure boot, and the generation of secure random data used in cryptographic key generation.
\r\nThe executing TOE is divided into user space and kernel space. User space contains processes that execute in their own protected memory space and access services provided by the kernel. Kernel space contains the macOS kernel (including device drivers and kernel extensions) that also executes in its own protected memory space. The kernel enforces process separation, provides processes with controlled access to hardware devices, and implements many other OS features.
","evaluation_configuration":"The evaluation covers the following Apple devices:
\r\n| \r\n Marketing Name \r\n | \r\n\r\n Model \r\n | \r\n\r\n Model Identifier \r\n | \r\n\r\n Processor | \r\n\r\n Security Chip \r\n | \r\n\r\n BT Version | \r\n
| \r\n 2025 \r\n | \r\n|||||
| \r\n MacBook Air (15-inch, M4, 2025) \r\n | \r\n\r\n A3241 \r\n | \r\n\r\n Mac16,13 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (13-inch, M4, 2025) \r\n | \r\n\r\n A3240 \r\n | \r\n\r\n Mac16,12 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac Studio (2025) \r\n | \r\n\r\n A3143 \r\n | \r\n\r\n Mac16,9 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2024 \r\n | \r\n|||||
| \r\n MacBook Pro (14-inch, 2024) \r\n | \r\n\r\n A3401 \r\n | \r\n\r\n Mac16,8 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3185 \r\n | \r\n\r\n Mac16,6 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n A3112 \r\n | \r\n\r\n Mac16,1 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Pro (16-inch, 2024) \r\n | \r\n\r\n A3403 \r\n | \r\n\r\n Mac16,7 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3186 \r\n | \r\n\r\n Mac16,5 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n iMac (24-inch, 2024, Four ports) \r\n | \r\n\r\n A3137 \r\n | \r\n\r\n Mac16,3 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3247 \r\n | \r\n\r\n Mac16,2 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n Mac mini (2024) \r\n | \r\n\r\n A3239 \r\n | \r\n\r\n Mac16,11 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3238 \r\n | \r\n\r\n Mac16,10 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Air (15-inch, M3, 2024) \r\n | \r\n\r\n A3114 \r\n | \r\n\r\n Mac15,13 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (13-inch, M3, 2024) \r\n | \r\n\r\n A3113 \r\n | \r\n\r\n Mac15,12 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2023 \r\n | \r\n|||||
| \r\n MacBook Pro (14-inch, Nov 2023) \r\n | \r\n\r\n A2992 \r\n | \r\n\r\n Mac15,10 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac15,8 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac15,6 \r\n | \r\n\r\n M3 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n A2918 \r\n | \r\n\r\n Mac15,3 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Pro (16-inch, Nov 2023) \r\n | \r\n\r\n A2991 \r\n | \r\n\r\n Mac15,11 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac15,9 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac15,7 \r\n | \r\n\r\n M3 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n iMac (24-inch, 2023) \r\n | \r\n\r\n A2873 \r\n | \r\n\r\n Mac15,5 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A2874 \r\n | \r\n\r\n Mac15,4 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n Mac Pro (-/Rack 2023) \r\n | \r\n\r\n A2786 \r\n | \r\n\r\n Mac14,8 \r\n | \r\n\r\n M2 Ultra (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (15-inch, 2023) \r\n | \r\n\r\n A2941 \r\n | \r\n\r\n Mac14,15 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4387) \r\n | \r\n
| \r\n Mac Studio (2023) \r\n | \r\n\r\n A2901 \r\n | \r\n\r\n Mac14,14 \r\n | \r\n\r\n M2 Ultra (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,13 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n MacBook Pro (16-inch, 2023) \r\n | \r\n\r\n A2780 \r\n | \r\n\r\n Mac14,6 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,10 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n MacBook Pro (14-inch, 2023) \r\n | \r\n\r\n A2779 \r\n | \r\n\r\n Mac14,5 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,9 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac mini (M2 Pro, 2023) \r\n | \r\n\r\n A2816 \r\n | \r\n\r\n Mac14,12 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac mini (M2, 2023) \r\n | \r\n\r\n A2686 \r\n | \r\n\r\n Mac14,3 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2022 \r\n | \r\n|||||
| \r\n MacBook Pro (13-inch, M2, 2022) \r\n | \r\n\r\n A2338 \r\n | \r\n\r\n Mac14,7 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
| \r\n MacBook Air (M2, 2022) \r\n | \r\n\r\n A2681 \r\n | \r\n\r\n Mac14,2 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4387) \r\n | \r\n
| \r\n Mac Studio (2022) \r\n | \r\n\r\n A2615 \r\n | \r\n\r\n Mac13,2 \r\n | \r\n\r\n M1 Ultra (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n
| \r\n Mac13,1 \r\n | \r\n\r\n M1 Max (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n||
| \r\n 2021 \r\n | \r\n|||||
| \r\n MacBook Pro (16-inch, 2021) \r\n | \r\n\r\n A2485 \r\n | \r\n\r\n MacBookPro18,2 \r\n | \r\n\r\n M1 Max (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n
| \r\n MacBookPro18,1 \r\n | \r\n\r\n M1 Pro (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n||
| \r\n MacBook Pro (14-inch, 2021) \r\n | \r\n\r\n A2442 \r\n | \r\n\r\n MacBookPro18,4 \r\n | \r\n\r\n M1 Max (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n
| \r\n MacBookPro18,3 \r\n | \r\n\r\n M1 Pro (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4387) \r\n | \r\n||
| \r\n iMac (24-inch, M1, 2021) \r\n | \r\n\r\n A2438 \r\n | \r\n\r\n iMac21,1 \r\n | \r\n\r\n M1 (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
| \r\n A2439 \r\n | \r\n\r\n iMac21,2 \r\n | \r\n\r\n M1 (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n|
| \r\n 2020 \r\n | \r\n|||||
| \r\n Mac mini (M1, 2020) \r\n | \r\n\r\n A2348 \r\n | \r\n\r\n Macmini9,1 \r\n | \r\n\r\n M1 (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
| \r\n MacBook Air (M1, 2020) \r\n | \r\n\r\n A2337 \r\n | \r\n\r\n MacBookAir10,1 \r\n | \r\n\r\n M1 (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
| \r\n MacBook Pro (13-inch, M1, 2020) \r\n | \r\n\r\n A2338 \r\n | \r\n\r\n MacBookPro17,1 \r\n | \r\n\r\n M1 (ARMv8.5-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the Apple macOS 15 Sequoia was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation was the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 5 supplemented by that found in the Protection Profiles cited above. The evaluation was completed in February 2026. The product, when delivered and configured as identified in the Apple macOS 15 Sequoia Common Criteria Guide, meets the requirements of the following:
\r\nThe TOE generates audit events for all start-up and shut-down functions, and all auditable events as specified by the conformance claims defined by the PPs. Audit events are generated for the following audit functions:
\r\nEach audit record contains the date and time of the event, type of event, subject identity (if applicable), and outcome (success or failure) of the event.
\r\nThe TOE includes the Apple corecrypto v18.3 cryptographic libraries and is supported by the onboard Apple Secure Enclave hardware for performing user space, kernel space, and Secure Enclave cryptographic operations. In addition, it uses software and hardware noise sources for entropy generation.
\r\nThe TOE implements Transport Layer Security version 1.2 (TLS 1.2) for secure communications with remote servers. The Bluetooth hardware implements the AES-CCM-128 cryptographic functionality used when connecting to remote Bluetooth devices. The TOE implements Wi-Fi Protected Access (WPA2 and WPA3) to secure 802.11 wireless traffic protected using AES-CCMP-256 and AES-GCMP-256 cryptographic algorithms.
\r\nThe TOE implements access controls that prevent unprivileged users from accessing files and directories owned by other users.
\r\nAll users must be authenticated to the TOE prior to carrying out any management actions. The TOE supports:
\r\nThe TOE will deny further user authentication once a defined number of unsuccessful authentication attempts have been reached.
\r\nFor Bluetooth, the TOE supports Secure Simple Pairing (SSP). It requires user authorization and mutual authentication during pairing. It also discards pairing attempts and session initialization from Bluetooth devices to which an active session already exists. The TOE requires explicit user authorization when pairing with an untrusted device.
\r\nExternal entities connecting to the TOE via a secure protocol (e.g., TLS, Extensible Authentication Protocol TLS (EAP-TLS)) can be authenticated using X.509 certificates.
\r\nThe TOE can perform management functions. The administrator has full access to carry out all management functions, whereas the user has limited privileges.
\r\nProtection of the TSF
\r\nThe TOE implements the following protection of TOE Security Functionality:
\r\nTOE Access
\r\nBefore establishing a user session, the TOE can display an advisory warning message regarding unauthorized use of the OS. Access to the TOE via a wireless network is controlled by administrator defined policy.
\r\nTOE Trusted Path/Channel
\r\nThe TOE supports TLS 1.2 for trusted channel communications. The TOE uses TLS to securely communicate with the Apple Update Server. Applications may invoke the TOE-provided TLS to securely communicate with remote servers. The TOE enforces encryption when transmitting data over Bluetooth and terminates the connection if the connected device stops encrypting. The TOE uses EAP-TLS for authentication and WPA for data encryption when connecting to a wireless access point as the WLAN client.
\r\n","features":[]}