The macOS system must disable the TouchID System Settings pane.

The System Settings pane for TouchID must be disabled.

Disabling the System Settings pane prevents the users from configuring TouchID.

Verify the macOS system is configured to disable the TouchID System Settings pane with the following command:

/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension"

If the result is not "1", this is a finding.

Configure the macOS system to disable the TouchID System Settings pane by installing the "com.apple.systempreferences" configuration profile.