Baselines

The strictest published profile for a platform, built from what the Register holds: every CAT I and CAT II rule of a STIG, the matching Microsoft baseline or NIST macOS rules, and the NIST SP 800-53 High baseline controls. Untick what you cannot do, and export the rest as a guide for Jamf, Intune or a Linux shell. Nothing on these pages is generated by a model; every line is the publisher's.

Windows3 STIGs loaded

Microsoft Windows 11, Microsoft Windows Server 2022, Microsoft Windows Server 20259 Microsoft baselines SP 800-53 High loaded

A Windows STIG, Microsoft's Security Compliance Toolkit baseline for the same product, DISA's Intune policy and checklist, and the SP 800-53 High controls.
macOS2 STIGs loaded

Apple macOS 15 (Sequoia), Apple macOS 26 (Tahoe)2 mSCP branches SP 800-53 High loaded

A macOS STIG joined to NIST's macOS Security Compliance Project rules (payload keys for Jamf), and the SP 800-53 High controls.
Linux4 STIGs loaded

Canonical Ubuntu 22.04 LTS, Canonical Ubuntu 24.04 LTS, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9SP 800-53 High loaded

A Linux STIG with its fix procedures, and the SP 800-53 High controls.
iOS2 STIGs loaded

Apple iOS/iPadOS 26, Apple iOS/iPadOS 271 mSCP branch SP 800-53 High loaded

DISA's Apple iOS/iPadOS STIG joined to NIST's mSCP iOS rules (configuration-profile keys for Jamf or Intune), and the SP 800-53 High controls.
iPadOS2 STIGs loaded

Apple iOS/iPadOS 26, Apple iOS/iPadOS 271 mSCP branch SP 800-53 High loaded

The same Apple iOS/iPadOS STIG and mSCP iOS rules as iOS, built and tested separately for an iPad fleet.
Android3 STIGs loaded

Google Android 16 COBO, Google Android 17 COBO, Samsung Android 16 COBOSP 800-53 High loaded

DISA's Google Android and Samsung Android with Knox STIGs for company-owned devices, and the SP 800-53 High controls.

How a profile is built

A STIG's rules come first. On Windows, Microsoft's Security Compliance Toolkit settings are joined to rules by registry path and the rest listed as what Microsoft adds; DISA's own Intune policy and checklist say which rules its settings-catalog policy sets and which are outside its scope. On macOS, NIST's macOS Security Compliance Project rules are joined by STIG id and carry the configuration-profile keys. Every rule maps to SP 800-53 through DISA's CCIs; the High baseline's controls close the list, each with the rules that implement it.

What is never exported

CIS Benchmark text (your own upload, your own licence) and anything a model wrote. Microsoft's values appear only as the page quotes them. Each export carries the publishers' attributions.

Test plans

What to test on a new OS release so the baseline still holds, by area, from the STIG and mSCP checks plus the owner's templates: Windows, macOS, Linux; from the templates alone: iOS, iPadOS, Android, Collaboration. Each release and the hardware it runs on are on the Fleet page.