refactor[rules] 1.0 -> 2.0 merge

Updated rules.

Author: robertgendler

src/mscp/data/rules/os/os_airprint_credential_storage_disable.yaml

@@ -7,6 +7,8 @@ references:
     cce:
       ios_26:
         - CCE-95641-7
+      ios_18:
+        - CCE-94527-9
     800-53r5:
       - CM-6
   disa:

src/mscp/data/rules/os/os_anti_virus_installed.yaml

@@ -18,10 +18,8 @@ references:
       - CCI-000366
   bzk:
     bio:
-      - 8.07.01
-      - 8.07.03
-      - 8.07.04
-      - 8.19.01
+      - 8.07
+      - 8.19
   cis:
     benchmark:
       macos_26:

src/mscp/data/rules/os/os_authenticated_root_enable.yaml

@@ -45,7 +45,7 @@ references:
       - SC.L2-3.13.11
   bzk:
     bio:
-      - 5.16.02
+      - 5.16
   hhs:
     hicp:
       - 2.L.A

src/mscp/data/rules/os/os_authentication_password_autofill_enable.yaml

@@ -30,7 +30,7 @@ references:
         - ANNEX K
   bzk:
     bio:
-      - 8.27 - 3.3
+      - 8.27
   cis:
     benchmark:
       ios_26:

src/mscp/data/rules/os/os_automatic_app_download_disable.yaml

@@ -7,6 +7,8 @@ references:
     cce:
       ios_26:
         - CCE-95654-0
+      ios_18:
+        - CCE-94528-7
     800-53r5:
       - CM-7
       - CM-7(1)

src/mscp/data/rules/os/os_background_security_improvement_install_enable.yaml

@@ -6,7 +6,7 @@ references:
   nist:
     cce:
       ios_26:
-        - CCE-NA
+        - CCE-96728-1
   bzk:
     bio:
       - 8.08

src/mscp/data/rules/os/os_background_security_improvement_removal_disable.yaml

@@ -6,7 +6,7 @@ references:
   nist:
     cce:
       ios_26:
-        - CCE-NA
+        - CCE-96729-9
   bzk:
     bio:
       - 8.08

src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml

@@ -0,0 +1,51 @@
+id: os_external_apfs_hfs_volumes_encrypted
+title: Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted
+discussion: |
+  All APFS and HFS+ external user storage volumes _MUST_ be encrypted.
+
+  While FileVault protects the boot volume, data may be copied to attached external storage and reduce the protection afforded by FileVault. All external user data volumes (APFS or HFS+) _MUST_ be encrypted to protect user data from loss or tampering. CoreStorage has been deprecated and replaced with APFS for volume encryption.
+references:
+  nist:
+    cce:
+      macos_26:
+        - CCE-96724-0
+  cis:
+    benchmark:
+      macos_26:
+        - 5.3.2 (level 1)
+    controls_v8:
+      - 3.6
+      - 3.11
+      - 13.6
+      - 14.8
+platforms:
+  macOS:
+    '26.0':
+      benchmarks:
+        - name: cis_lvl1
+        - name: cis_lvl2
+    enforcement_info:
+      check:
+        shell: |-
+          fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk '
+            /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)}
+            /FileVault:/{
+              if ($2=="No") {
+                if (list=="") list=name; else list=list ", " name
+              }
+            }
+            END{print list}')
+          if [ -z "$fail" ]; then
+            /bin/echo "Yes"
+          else
+            /bin/echo "Unencrypted external volumes: $fail"
+          fi
+        result:
+          string: 'Yes'
+      fix:
+        additional_info: |-
+          Use Disk Utility to erase a user disk and format as APFS (Encrypted).
+
+          NOTE: It is recommended using APFS over HFS+ where possible. If you do need to use an HFS+/CoreStorage external drive for compatibility reasons, you need to format the drive to MacOS Extended (Journaled) (or MacOS Extended (Case-Sensitive, Journaled) if Case-Sensitive is required).
+tags:
+  - cisv8

src/mscp/data/rules/os/os_external_intelligence_integration_sign_in_disable.yaml

@@ -43,7 +43,6 @@ references:
   bzk:
     bio:
       - 8.12
-      - 8.12.01
   cis:
     benchmark:
       ios_26:

src/mscp/data/rules/os/os_external_storage_access_defined.yaml

@@ -21,7 +21,7 @@ references:
       - MP.L2-3.8.8
   bzk:
     bio:
-      - 8.12.01
+      - 8.12
 platforms:
   macOS:
     '26.0':