Bob Gendler of NIST — the lead architect of the macOS Security Compliance Project (mSCP) — invited Smplify to the 2026 mSCP Developer Day to share how developers can build and extend mSCP 2.0. Artifacts from the session:
Replace Months of Infrastructure Work
with One API Call
An experienced Mac admin working with mSCP and a configured MDM platform may require 2–3 days to implement compliance across a fleet. For anyone with less experience, it could take far longer.
Smplify compresses that into a single API call.
Supported baselines
NISTDISA STIGCMMCCISCNSSIBIO (Netherlands)policies.create.js
// Enforce an mSCP 2.0 NIST Baseline across an entire tenant fleet
const smplify = require('@smplify/node')('sk_live_2026_prod');
await smplify.policies.create({
tenant_id: 'tenant_enterprise_delta_9',
platform: 'macos',
engine: 'ddm',
framework: 'mscp_2.0',
baseline: 'nist_800_53_rev5_required',
enforcement: 'strict'
});You Could Build This Yourself
What you’re signing up for
- Low-level protocol work. Apple’s DDM isn’t a simple REST wrapper. Mapping plist structures, XML profiles, and payload schemas is deep, specialized work — before you’ve written a line of product code.
- A permanent maintenance commitment. Apple updates MDM behaviors on their schedule. Once you build it, someone owns it indefinitely. Engineering capacity that should be building your product.
- The mSCP translation problem. Bridging mSCP 2.0 YAML baselines to your MDM layer is a project in itself — unless your infrastructure was designed for it from the start.
- Compliance expertise is a discipline. NIST 800-53, DISA STIG, CIS — getting these wrong is measured in audit failures, not just bugs.
The Smplify alternative
- API-first by design. Every capability is a clean API call. Your engineers build product, not plumbing.
- mSCP 2.0 native. YAML baselines map directly to deployable policies. No manual translation.
- AI and MCP server ready. Real data, real schemas, real enforcement. No retrofitting required.
- Schema-validated profiles, not approximations. mSCP 2.0’s structured YAML gives our MCP server exact source data to work from. Every profile it builds is deployable — not theoretical.
- Apple DDM native. Supported natively across the entire Apple device ecosystem. One infrastructure layer from day one.
- Your product stays yours. Smplify is infrastructure — not a dashboard your customers will see, not a competing product.