BaselineWatch
281 checks
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

macOS test plan

What to test on a macOS release so the baseline still holds: the checks of Apple macOS 26 (Tahoe) V1R4 and macOS 26.0: Tahoe Guidance, Revision 3.0 (cf656e8), by area
Derive from
The release under test
Areas to test Untick an area to leave it out of the exports; it stays on the page, marked as not tested this time.
Export the kept checks Untick a check, then Rebuild or export; the form carries the state and nothing is stored. One area is drawn at a time; what you untick in one is kept when you open another, and every export covers the whole plan: the checks kept, what was left out and why, a findings table and a sign-off.
The report looks
Plain
Calibri and grey tables, nothing else: the look before styles.
Formal assessment
A government assessment report in the SP 800-53A manner: serif headings, numbered sections, cover page. Cover page. Numbered sections.
Engineering runbook
For the engineer at the keyboard: monospaced headings, dark command blocks. Numbered sections.
Executive
Navy and teal with a cover page: for the people who sign it off. Cover page.
Compact checklist
Black on white, small type, no cover: prints the most checks per page.
Modern
A clean product look in indigo and slate.
Dark console
Light text on a dark page, terminal colours: for screens, not paper.
Board
Issue-tracker blues and lane greys, as the decisions board draws them.
Audit workpaper
Ledger green and auditor blue, with room for initials and references. Cover page. Numbered sections.
Markdown-native
How the report reads on GitHub: system fonts, ruled headings, grey code.
Word
Office's own blues: the house style of a document written in Word. Cover page. Numbered sections.

The look applies to Word, PDF, LaTeX and the printable checklist; Markdown, CSV and JSON stay plain. Each follows one of the mockups in docs/mockups/exports.

Link to this plan: the release, hardware and areas as a URL to bookmark or send; unticked checks do not travel with it.

Hardware root of trust and secure enclave 11 kept

  1. Procedure

    Verify the macOS system is configured to enable SIP with the following command: /usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' If the result is not "1", this is a finding.

  2. Procedure

    Verify the macOS system is configured to enable authenticated root with the following command: /usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;" If the result is not "1", this is a finding.

  3. Procedure

    Verify the macOS system is configured to ensure Secure Boot level is set to "full" using the following command: /usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" If the result is not "1", this is a finding.

  4. Procedure

    /usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes"

  5. Apple, "Mac models with the Apple T2 Security Chip" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: An Apple silicon Mac reports a Chip line (Apple M-series); an Intel Mac with a T2 reports the Apple T2 Security Chip in the iBridge pane. Record which, because the boot checks below differ.
    If it does not: An Intel Mac with no T2 line has no Secure Enclave; skip the boot-policy and Activation Lock steps, record the model, and plan its replacement (macOS 15 Sequoia is its last release).
  6. Apple Platform Security, "Startup Disk security policy control for a Mac with Apple silicon" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: The policy for the startup volume is Full Security.
    If it does not: Reduced or Permissive Security means a person or a kext lowered it; restart into recoveryOS, open Startup Security Utility and set Full Security, then find why it was lowered. Never change the policy with bputil itself.
  7. Apple, "About Startup Security Utility on a Mac with an Apple T2 Security Chip" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: Secure Boot is Full Security, booting from external or removable media is disallowed, and a firmware password is set.
    If it does not: Set Full Security and disallow external boot; set the firmware password from the same utility and escrow it.
  8. Apple Platform Security, "Signed system volume security" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: System Integrity Protection is enabled and Authenticated Root is enabled (the signed system volume is sealed).
    If it does not: Either disabled is a finding; re-enable from recoveryOS (csrutil enable, csrutil authenticated-root enable). On Apple silicon, SIP can only be disabled under a Permissive policy, so a disabled SIP means the boot policy drifted too.
  9. Apple Platform Deployment, "Use secure token, bootstrap token and volume ownership in deployments" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: FileVault is On; the admin account has a secure token; the bootstrap token is escrowed with the MDM.
    If it does not: FileVault off means the MDM FileVault payload did not apply (deferred enablement waits for the next sign-in); a missing bootstrap token means the Mac was not enrolled through Automated Device Enrollment or the token was never escrowed, so grant it through the MDM before any further account work.
  10. Apple Platform Security, "Gatekeeper and runtime protection in macOS" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: Gatekeeper assessments are enabled.
    If it does not: Run sudo spctl --master-enable and make the MDM enforce Gatekeeper so it cannot be turned off again.
  11. Apple Platform Deployment, "Activation Lock on Apple devices" (Secure Enclave, secure boot and the signed system on a Mac)
    Success looks like: Activation Lock is enabled and organisation-linked through the MDM.
    If it does not: Activation Lock needs Full Security (Apple silicon) or Secure Boot (T2), Find My on, and two-factor on the Apple Account; a supervised Mac is locked by the MDM, so check the MDM's Activation Lock setting first.