macOS CIS Level 1Compliance Report

Executive Summary

This session demonstrates end-to-end automated macOS security compliance using the NIST macOS Security Compliance Project (mSCP) 2.0 framework integrated with Smplify MDM. The session was initiated from a fleet with zero compliance policies deployed and concluded with six CIS Level 1 configuration profiles created, tagged, and ready for staged deployment — without disrupting any enrolled devices.

Accomplishments

Fleet inventory and risk assessment. All six enrolled devices were inventoried from Smplify. Key findings included a device stuck in UNENROLL_PENDING state with no active MDM enforcement, an unassigned iPhone on a different tenant, and a MacBook Air running macOS 15.7.5 — significantly behind the current fleet OS version of 26.5.

CIS Level 1 baseline interpretation. The live cis_lvl1.yaml from the mSCP GitHub repository was fetched and parsed. All 90+ rules were mapped to Apple MDM payload identifiers and organized into six logical policy groups.

Six production-ready profiles built and tagged. Profiles were created in Smplify covering firewall, full-disk encryption, password policy, screen lock, login window hardening, and software update enforcement. All profiles were tagged "NIST mSCP Demo" for tracking. No profiles were deployed.

UAMDM prerequisite identified. The FileVault profile (com.apple.MCX.FileVault2) was flagged as requiring User Approved MDM enrollment before enforcement — the only profile in the set with this constraint.

Compliance gap and disruption analysis. Each profile was assessed against each eligible macOS device. All six devices fail all six controls (no policies installed). Four controls were classified as safe for immediate automated remediation; two require advance notice to users.

CIS Level 1 → NIST 800-53r5 Moderate upgrade path. A full baseline diff was produced, identifying approximately 25 net-new rules, 10 ODV value changes, and 28 CIS-only controls not required by 800-53r5 Moderate. Per-rule customization values and rationale were documented.

Fleet Snapshot

The following devices were inventoried from the Smplify tenant at the time of this session. CIS Level 1 profiles apply exclusively to macOS devices; iOS and iPadOS devices are out of scope for this baseline.

CIS Level 1 Configuration Profiles

The following six profiles were built in Smplify using Apple MDM payload schemas, mapped to the CIS Apple macOS 26.0 Tahoe v1.0.0 Benchmark Level 1 rules from the mSCP 2.0 cis_lvl1.yaml baseline. Each profile is documented using the mSCP guidance structure: discussion, check, fix, result, and references.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

fdesetup status

/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | \
  /usr/bin/tail +2 | /usr/bin/xmllint --xpath \
  'boolean(//*[contains(text(),"policyAttributePassword")])' -

osascript -e 'tell application "System Events" to \
  tell security preferences to get require password to wake'
defaults -currentHost read com.apple.screensaver idleTime

defaults read /Library/Preferences/com.apple.SoftwareUpdate \
  AutomaticCheckEnabled AutomaticDownload \
  CriticalUpdateInstall ConfigDataInstall \
  AutomaticallyInstallMacOSUpdates

User Approved MDM (UAMDM) Requirement

Apple introduced User Approved MDM in macOS 10.13.2 as a security measure to prevent silent, unauthorized MDM enrollment. Certain high-privilege configuration payloads — including kernel extensions, system extensions, privacy preference policy controls, and FileVault management — require that the device owner explicitly approve the MDM enrollment before these profiles will be accepted.

Per-Device UAMDM Assessment

How to Verify UAMDM Status

Run the following on each device to confirm UAMDM approval status:

Look for MDM enrollment: Yes (User Approved) in the output. If the response shows Yes without User Approved, the device requires manual approval in System Settings before the FileVault profile will take effect.

Compliance Gap Analysis

At the time of this session, no MDM policies of any kind were installed on any macOS device in the fleet. The following table summarizes the compliance posture against each CIS L1 profile for each in-scope device.

Baseline Upgrade: CIS Level 1 → NIST 800-53r5 Moderate

The following analysis documents the rule-level changes required to migrate from the CIS Apple macOS 26.0 Tahoe v1.0.0 Level 1 baseline to the NIST SP 800-53 Rev 5 Moderate baseline, as defined in the mSCP 800-53r5_moderate.yaml file.

Key Net-New Rules (800-53r5 Moderate Only)

Rules Requiring ODV Value Changes

CIS-Only Rules Not in 800-53r5 Moderate

These rules exist in cis_lvl1.yaml but have no corresponding tag in 800-53r5_moderate.yaml. They can be retained for defense-in-depth but are not required for Moderate compliance. Notable examples include all Safari privacy controls (os_safari_*), Siri and dictation controls (system_settings_siri_disable, os_on_device_dictation_enforce), Apple Intelligence controls (system_settings_external_intelligence_*), and CIS-specific manual checks (supplemental_cis_manual).

Manual Effort Comparison

The following table estimates the time a skilled macOS administrator — with working knowledge of the mSCP framework, Apple MDM protocol reference, and the Smplify console — would require to replicate this session's output manually.

Note: Manual estimate assumes an experienced administrator already familiar with mSCP, Apple MDM payloads, and Smplify. For administrators newer to any of these three areas, the estimate extends to 5–7 days. The baseline diff task (Section 6) is typically scoped as a multi-day engagement for a dedicated compliance consultant.

References

• 1
  NIST macOS Security Compliance Project (mSCP)
  https://github.com/usnistgov/macos_security
  Joint project of NIST, NASA, DISA, and LANL. Technical implementation of NIST SP 800-219 Rev. 1.
• 2
  CIS Apple macOS 26.0 Tahoe v1.0.0 Benchmark
  https://www.cisecurity.org/benchmark/apple_os_x
  mSCP baseline: baselines/cis_lvl1.yaml
• 3
  NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
  https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
  mSCP baseline: baselines/800-53r5_moderate.yaml
• 4
  NIST SP 800-219 Rev 1 — Automated Secure Configuration Guidance from the mSCP
  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-219r1.pdf
• 5
  Apple Mobile Device Management Protocol Reference
  https://developer.apple.com/documentation/devicemanagement
  Authoritative reference for all MDM payload identifiers and keys used in this report.
• 6
  Apple Platform Security Guide
  https://support.apple.com/guide/security/welcome/web
  Technical documentation on FileVault, Secure Enclave, Gatekeeper, System Integrity Protection, and related controls referenced in this report.
• 7
  Smplify MDM Platform
  https://smplify.com
  MDM platform used in this session.
• 8
  User Approved MDM — Apple Platform Deployment
  https://support.apple.com/guide/deployment/
  Documentation on UAMDM enrollment requirements and verification for macOS managed devices.
• 9
  NIST SP 800-111 — Guide to Storage Encryption Technologies for End User Devices
  https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf
  Supporting reference for FileVault full-disk encryption controls (SC-28).
• 10
  mSCP Pages — Interactive Guidance Documentation
  https://pages.nist.gov/macos_security
  Human-readable guidance documents generated from the mSCP rule library, including HTML and PDF exports for all supported baselines.