Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)



Mark Trapnell, Eric Trapnell, Murugiah Souppaya, Bob Gendler, Karen Scarfone


The macOS Security Compliance Project (mSCP) provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way. This publication introduces the mSCP and gives an overview of the resources available from the project's GitHub site, which is continuously curated and updated to support each new release of macOS. The GitHub site provides practical, actionable recommendations in the form of secure baselines and associated rules. This publication also describes use cases for leveraging the mSCP content.
Special Publication (NIST SP) - 800-219
Report Number


Apple, baseline, configuration management, endpoint device security, macOS, macOS Security Compliance Project (mSCP), operating system security, security compliance


Trapnell, M. , Trapnell, E. , Souppaya, M. , Gendler, B. and Scarfone, K. (2022), Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP), Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online],, (Accessed April 20, 2024)
Created June 24, 2022, Updated November 29, 2022