The TOE is a general purpose operating system running on the Apple Mac computers with Apple silicon. The Mac computers covered in this evaluation contain the Secure Enclave, a dedicated secure subsystem integrated into the Apple silicon.
\r\nUtilizing a dedicated processor (Secure Enclave Processor, or SEP), the Secure Enclave is isolated from the main processor to provide an extra layer of security designed to keep sensitive data secure. The SEP executes the SEP Operating System (sepOS), which is based on a customized version of the L4 microkernel. sepOS is included with macOS and is within the TOE boundary. The Secure Enclave supports the TOE for secure boot, and the generation of secure random data used in cryptographic key generation.
\r\nThe executing TOE is divided into user space and kernel space. User space contains processes that execute in their own protected memory space and access services provided by the kernel. Kernel space contains the macOS kernel (including device drivers and kernel extensions) that also executes in its own protected memory space. The kernel enforces process separation, provides processes with controlled access to hardware devices, and implements many other OS features. The SEP is only accessible by the macOS kernel.
\r\nThe TOE hardware platforms include a third-party chip that implements Bluetooth and wireless LAN functionality.
","evaluation_configuration":"The evaluation covers the following Apple devices:
\r\n| \r\n Marketing Name \r\n | \r\n\r\n Model \r\n | \r\n\r\n Model Identifier \r\n | \r\n\r\n Processor | \r\n\r\n Security Chip \r\n | \r\n\r\n BT Version | \r\n
| \r\n 2025 \r\n | \r\n|||||
| \r\n MacBook Pro (14-inch, M5) \r\n | \r\n\r\n A3434 \r\n | \r\n\r\n Mac17,2 \r\n | \r\n\r\n M5 (ARMv9.3-A) \r\n | \r\n\r\n SEP v3.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (15-inch, M4, 2025) \r\n | \r\n\r\n A3241 \r\n | \r\n\r\n Mac16,13 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (13-inch, M4, 2025) \r\n | \r\n\r\n A3240 \r\n | \r\n\r\n Mac16,12 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac Studio (2025) \r\n | \r\n\r\n A3143 \r\n | \r\n\r\n Mac16,9 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac Studio (2025) \r\n | \r\n\r\n A3389 \r\n | \r\n\r\n Mac15,14 \r\n | \r\n\r\n M3 Ultra (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2024 \r\n | \r\n|||||
| \r\n MacBook Pro (14-inch, 2024) \r\n | \r\n\r\n A3401 \r\n | \r\n\r\n Mac16,8 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3185 \r\n | \r\n\r\n Mac16,6 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n A3112 \r\n | \r\n\r\n Mac16,1 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Pro (16-inch, 2024) \r\n | \r\n\r\n A3403 \r\n | \r\n\r\n Mac16,7 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3186 \r\n | \r\n\r\n Mac16,5 \r\n | \r\n\r\n M4 Max (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n iMac (24-inch, 2024, Two ports) \r\n | \r\n\r\n A3137 \r\n | \r\n\r\n Mac16,3 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3247 \r\n | \r\n\r\n Mac16,2 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n Mac mini (2024) \r\n | \r\n\r\n A3239 \r\n | \r\n\r\n Mac16,11 \r\n | \r\n\r\n M4 Pro (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n A3238 \r\n | \r\n\r\n Mac16,10 \r\n | \r\n\r\n M4 (ARMv9.2-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Air (15-inch, M3, 2024) \r\n | \r\n\r\n A3114 \r\n | \r\n\r\n Mac15,13 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (13-inch, M3, 2024) \r\n | \r\n\r\n A3113 \r\n | \r\n\r\n Mac15,12 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2023 \r\n | \r\n|||||
| \r\n MacBook Pro (14-inch, Nov 2023) \r\n | \r\n\r\n A2992 \r\n | \r\n\r\n Mac15,10 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac15,8 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac15,6 \r\n | \r\n\r\n M3 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n A2918 \r\n | \r\n\r\n Mac15,3 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n|
| \r\n MacBook Pro (16-inch, Nov 2023) \r\n | \r\n\r\n A2991 \r\n | \r\n\r\n Mac15,11 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac15,9 \r\n | \r\n\r\n M3 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac15,7 \r\n | \r\n\r\n M3 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n iMac (24-inch, 2023, Four ports) \r\n | \r\n\r\n A2873 \r\n | \r\n\r\n Mac15,5 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n iMac (24-inch, 2023, Two ports) \r\n | \r\n\r\n A2874 \r\n | \r\n\r\n Mac15,4 \r\n | \r\n\r\n M3 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac Pro (-/Rack 2023) \r\n | \r\n\r\n A2786 \r\n | \r\n\r\n Mac14,8 \r\n | \r\n\r\n M2 Ultra (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n MacBook Air (15-inch, 2023) \r\n | \r\n\r\n A2941 \r\n | \r\n\r\n Mac14,15 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4387) \r\n | \r\n
| \r\n Mac Studio (2023) \r\n | \r\n\r\n A2901 \r\n | \r\n\r\n Mac14,14 \r\n | \r\n\r\n M2 Ultra (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,13 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n MacBook Pro (16-inch, 2023) \r\n | \r\n\r\n A2780 \r\n | \r\n\r\n Mac14,6 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,10 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n MacBook Pro (14-inch, 2023) \r\n | \r\n\r\n A2779 \r\n | \r\n\r\n Mac14,5 \r\n | \r\n\r\n M2 Max (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac14,9 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n||
| \r\n Mac mini (M2 Pro, 2023) \r\n | \r\n\r\n A2816 \r\n | \r\n\r\n Mac14,12 \r\n | \r\n\r\n M2 Pro (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n Mac mini (M2, 2023) \r\n | \r\n\r\n A2686 \r\n | \r\n\r\n Mac14,3 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4388) \r\n | \r\n
| \r\n 2022 \r\n | \r\n|||||
| \r\n MacBook Pro (13-inch, M2, 2022) \r\n | \r\n\r\n A2338 \r\n | \r\n\r\n Mac14,7 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.0 (4378) \r\n | \r\n
| \r\n MacBook Air (M2, 2022) \r\n | \r\n\r\n A2681 \r\n | \r\n\r\n Mac14,2 \r\n | \r\n\r\n M2 (ARMv8.6-A) \r\n | \r\n\r\n SEP v2.0 \r\n | \r\n\r\n 5.3 (4387) \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process. The criteria against which the Apple macOS 26 Tahoe TOE was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation was the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 5 supplemented by that found in the Protection Profiles cited above. The evaluation was completed in July 2026. The product, when delivered and configured as identified in the Apple macOS 26 Tahoe Common Criteria Guide, meets the requirements of the following:
\r\nSecurity Audit
\r\n\r\n
The TOE generates audit events for all start-up and shut-down functions, and all auditable events as specified by the Protection Profiles cited above. Audit events are generated for the following audit functions:
\r\n\r\n
Cryptographic Support
\r\n\r\n
User Data Protection
\r\nThe TOE implements access controls that prevent unprivileged users from accessing files and directories owned by other users.
\r\nIdentification and Authentication
\r\nAll users must be authenticated to the TOE prior to carrying out any management actions. The TOE supports:
\r\nThe TOE will deny further user authentication once a defined number of unsuccessful authentication attempts have been reached.
\r\nFor Bluetooth, the TOE supports Secure Simple Pairing (SSP). It requires user authorization and mutual authentication during pairing. It also discards pairing attempts and session initialization from Bluetooth devices to which an active session already exists. The TOE requires explicit user authorization when pairing with an untrusted device.
\r\nExternal entities connecting to the TOE via a secure protocol (e.g., TLS, Extensible Authentication Protocol TLS (EAP-TLS)) can be authenticated using X.509v3 certificates. X.509v3 certificates can be imported in the keychain by the administrator.
\r\nSecurity Management
\r\nThe TOE can perform management functions. The administrator has full access to carry out all management functions, whereas the user has limited privileges.
\r\nProtection of the TSF
\r\nThe TOE implements the following protection of TOE Security Functionality:
\r\nTOE Access
\r\nBefore establishing a user session, the TOE can display an advisory warning message regarding unauthorized use of the OS. Access to the TOE via a wireless network is controlled by administrator defined policy.
\r\nTOE Trusted Path/Channel
\r\nThe TOE supports TLS 1.2 for trusted channel communications. The TOE uses TLS to securely communicate with the Apple Update Server. Applications may invoke the TOE-provided TLS to securely communicate with remote servers. The TOE enforces encryption when transmitting data over Bluetooth and terminates the connection if the connected device stops encrypting. The TOE uses EAP-TLS for authentication and WPA for data encryption when connecting to a wireless access point as the WLAN client.
","features":[{"id":5586,"feature_name":"Asymmetric Key Generation"},{"id":5587,"feature_name":"Auditing"},{"id":5588,"feature_name":"Bluetooth"},{"id":5589,"feature_name":"Certificate Validation"},{"id":5590,"feature_name":"Credential Storage"},{"id":5591,"feature_name":"Cryptographic Key Establishment"},{"id":5592,"feature_name":"Cryptographic Signature Generation"},{"id":5593,"feature_name":"Cryptographic Signature Verification"},{"id":5594,"feature_name":"DRBG"},{"id":5595,"feature_name":"EAP-TLS using Mutual Authentication"},{"id":5596,"feature_name":"Hashing"},{"id":5597,"feature_name":"HTTPS Client"},{"id":5598,"feature_name":"Key Destruction"},{"id":5599,"feature_name":"Keyed-hash message authentication"},{"id":5600,"feature_name":"Operating System"},{"id":5602,"feature_name":"Secure Communications"},{"id":5603,"feature_name":"Self Test Function"},{"id":5604,"feature_name":"Symmetric Key Generation"},{"id":5605,"feature_name":"TLS 1.2"},{"id":5606,"feature_name":"TLS Client with Mutual Authentication"},{"id":5607,"feature_name":"Trusted Update Function"},{"id":5608,"feature_name":"Wi-Fi 6"},{"id":5609,"feature_name":"WLAN Client"},{"id":5610,"feature_name":"WPA2"},{"id":5611,"feature_name":"WPA3"}]}