Baseline and harden these machines
We move daily work onto standard accounts, enrol every Mac in device management, keep Gatekeeper and System Integrity Protection switched on, turn on FileVault with recovery keys you hold, and keep work files out of personal iCloud. Score your Macs below to see which of those you already have.
About two minutes. No email to see the result.
Fresh start, or adding protection to employee machines?
It sets the price. A machine nobody uses yet has nothing to work around, so it costs less to lock down. Got both kinds? Pick already in use.
No email until step 5.
The kit behind the fixes, written up for whoever has to run it.
The federal macOS Security Compliance Project, a collaboration of government agencies hosted by NIST, for generating security baselines on macOS. Supp...
Read the write-up →Santa is a binary authorization and monitoring system for macOS that allows or denies process execution based on certificate, hash, or path rules. Cre...
Read the write-up →Lynis is the free, open-source security auditor from CISOfy, and it runs on macOS as happily as it does on Linux. Download the archive, run lynis audi...
Read the write-up →FileVault is the full-disk encryption built into macOS, so a Mac left on a train opens for nobody without the password or its recovery key. This guide...
Read the write-up →The questions map to these benchmark topics. Section numbers move between releases, so we check them against the current benchmark at each audit instead of quoting them here.