BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Project Description

NIST platform security: roots of trust, firmware and secure enclaves SP 800-219
All changes in this version
first version loaded 2 Project Description

Title

Project Description

Control

The mSCP is an open-source project that provides a programmatic approach to generating and using macOS security configuration baselines. The project’s content can be used to create customized security baselines of technical security controls by leveraging a library of rules, with each rule mapped to requirements in one or more existing security standards, regulations, or frameworks. This approach provides versioning and consistency of the content. Unifying and standardizing macOS baseline efforts via the mSCP means that updating security guidance is simplified and radically accelerated, even as new versions of macOS are introduced annually.

The mSCP started in August 2019 as a collaboration among operational IT security staff from NIST, the National Aeronautics and Space Administration (NASA), the Defense Information Systems Agency (DISA), and the Department of Energy’s (DOE) Los Alamos National Laboratory (LANL). 1 The mSCP sought to map macOS settings to NIST SP 800-53, Revision 4 [5] with an extensible, modern approach to security guidance that could be used by any organization (e.g., government, enterprise, education) that needs to adhere to security compliance frameworks and policy.

As of this writing, the configuration settings represent guidance and best practices from NIST SP 800-53, Revision 5 [6] ; NIST SP 800-171, Revision 2 [7] ; the macOS DISA Security Technical Implementation Guide (STIG) [8] ; the Committee on National Security Systems (CNSS) Instruction (CNSSI) Number 1253 [9] ; the Center for Internet Security (CIS) Critical Security Controls Version 8 [10] ; and internal organizational security guidance from NIST, NASA, and LANL.