Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)

Trapnell, Mark; Trapnell, Eric; Souppaya, Murugiah; Gendler, Bob; Scarfone, Karen

doi:https://doi.org/10.6028/NIST.SP.800-219r1.ipd

SP 800-219 Rev. 1 (Draft)

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)

Documentation Topics

Date Published: March 13, 2023
Comments Due: April 27, 2023
Email Comments to: applesec@nist.gov

Author(s)

Mark Trapnell (NIST), Eric Trapnell (NIST), Murugiah Souppaya (NIST), Bob Gendler (NIST), Karen Scarfone (Scarfone Cybersecurity)

Announcement

This draft revision of NIST SP 800-219 provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way.

This publication introduces the mSCP, describes use cases for leveraging the mSCP content, and introduces a new feature of the mSCP that allows organizations to customize security rules more easily. The draft also gives an overview of the resources available on the project’s GitHub site, which provides practical, actionable recommendations in the form of secure baselines and associated rules and is continuously updated to support each new release of macOS.

NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Abstract

The macOS Security Compliance Project (mSCP) provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way. This publication introduces the mSCP and gives an overview of the resources available from the project’s GitHub site, which is continuously curated and updated to support each new release of macOS. The GitHub site provides practical, actionable recommendations in the form of secure baselines and associated rules. This publication also describes use cases for leveraging the mSCP content. Updates from the previous version of this publication mainly involve the new mSCP capability to create a custom benchmark by tailoring a baseline.

Keywords

Apple; baseline; configuration management; endpoint device security; macOS; macOS Security Compliance Project (mSCP); operating system security; security compliance

Control Families

None selected

Documentation

Publication:
SP 800-219 Rev. 1 (Draft) (DOI)
Local Download

Supplemental Material:
mSCP GitHub site (web)
mSCP project documentation (web)

Document History:
03/13/23: SP 800-219 Rev. 1 (Draft)

Topics

Security and Privacy
configuration management; controls assessment; security automation; security controls

Technologies
operating systems

Applications
enterprise