Stay compliant every day, not just at audit time.
Smplify applies mSCP baselines (NIST, DISA STIG, CMMC, CIS and more) across your Apple fleet with one API call, then keeps them applied. Build it into your product, or run it on your own fleet.
Bob Gendler of NIST, lead architect of the macOS Security Compliance Project (mSCP), invited Smplify to the 2026 mSCP Developer Day to show how developers can build on and extend mSCP 2.0. Artifacts from the session:
Days of compliance work, in one API call
Rolling out an mSCP baseline across a fleet can take an experienced Mac admin 2–3 days, and far longer for anyone less experienced. Smplify turns it into one API call.
Supported baselines
NISTDISA STIGCMMCCISCNSSIBIO (Netherlands)// Enforce an mSCP 2.0 NIST Baseline across an entire tenant fleet
const smplify = require('@smplify/node')('sk_live_2026_prod');
await smplify.policies.create({
tenant_id: 'tenant_enterprise_delta_9',
platform: 'macos',
engine: 'ddm',
framework: 'mscp_2.0',
baseline: 'nist_800_53_rev5_required',
enforcement: 'strict'
});Compliance workflows in the CLI
The Smplify CLI has compliance workflows built in, and it works as a skill for AI coding agents like Claude Code. It caches payload schemas locally and filters results itself, so only what the agent needs crosses into the model: fewer tokens and fewer round trips.
What you get:
- Guided compliance workflows
- Every mSCP baseline, or your own via an mSCP manifest
- Lower token use: schemas cached locally, results filtered before they reach the model
Evidence your auditor can check
Every change is attributed, approved where it matters, and logged. Audit records are hash-chained for tamper evidence and stream to your SIEM in OCSF. Separation of duties is enforced by the platform, not a runbook.
How separation of duties works →You could build this yourself. Here’s what that takes.
Map plists, XML profiles and DDM schemas before writing any product code
Every capability is one API call
Apple changes device management behavior on its schedule; someone owns that forever
Profiles are generated from Apple’s published schemas, so coverage follows Apple
Bridging mSCP baselines to your management layer is its own project
mSCP baselines map directly to deployable policies
Mistakes show up as audit failures, not bugs
NIST, DISA STIG and CIS baselines, evaluated continuously
Retrofit it later
The MCP server works from real schemas, so every profile it builds is deployable
Describe the baseline. Smplify keeps it applied.
Build compliance into your product or run it on your own fleet. Weeks to a working integration, not months.
- 01Tell us what you want your fleet to do. One short form, name, company, and the shape of your fleet.
- 02We read it, not a bot. One of the founders replies, usually same day.
- 03You get API access and docs. Enough to build something real before any commercial conversation.