What Are Baselines?

A baseline is a YAML file that defines which security rules apply to your environment. Each baseline maps to a compliance framework (NIST 800-53, CIS Benchmarks, DISA STIG, etc.) and includes all the rules needed to meet that framework’s requirements.

Once you have a baseline, the project scripts use it to generate everything you need: guidance documents, configuration profiles, compliance scripts, and more.

Tip

Think of a baseline as a shopping list of security settings. Your organization, industry, or regulatory requirements determine which baseline you need.

---

How Baselines Work

1. Choose a framework - Pick the compliance standard you need (NIST, CIS, STIG, etc.)
2. Generate the baseline - Run generate_baseline.py to create the YAML file
3. Customize if needed - Tailor the baseline to your organization’s requirements
4. Generate outputs - Use the baseline to create profiles, scripts, and documentation

Each baseline is specific to an operating system (macOS, iOS/iPadOS, or visionOS) and compliance level (High, Moderate, Low, or Level 1/2 depending on the framework).

---

Available Baselines

Baselines are located in the /baselines/ folder. Here’s what’s available:

Government Frameworks

Framework	Baseline Files
NIST 800-53 Rev 5	800-53r5_high.yaml, 800-53r5_moderate.yaml, 800-53r5_low.yaml
NIST 800-171	800-171.yaml
DISA STIG	macOS: DISA-STIG.yaml iOS: ios_stig.yaml, ios_stig_byoad.yaml
CMMC 2.0	cmmc_lvl1.yaml, cmmc_lvl2.yaml
CNSSI 1253	cnssi-1253_high.yaml, cnssi-1253_moderate.yaml, cnssi-1253_low.yaml

Industry Frameworks

Framework	Baseline Files
CIS Benchmarks (macOS)	cis_lvl1.yaml, cis_lvl2.yaml
CIS Benchmarks (iOS)	cis_lvl1_byod.yaml, cis_lvl2_byod.yaml cis_lvl1_enterprise.yaml, cis_lvl2_enterprise.yaml
CIS Controls v8	cisv8.yaml

International

Framework	Baseline Files
Indigo (iOS only)	indigo_base.yaml, indigo_high.yaml

Note

CIS Level 2 baselines include all Level 1 rules plus additional controls for higher security environments.

---

List Available Baselines

To see all baselines available for your current branch:

./scripts/generate_baseline.py -l

Example output:

800-53r5_high
800-53r5_moderate
800-53r5_low
cis_lvl1
cis_lvl2
DISA-STIG
cmmc_lvl1
cmmc_lvl2
...

---

Key Concepts

Concept	Description
Purpose	Define what security settings your systems should have
Customization	Tailor baselines to fit your organization’s specific needs
Auditing	Provide evidence that systems meet compliance standards
Automation	Scripts can check and fix settings automatically
Maintenance	Updated with each macOS release and when frameworks change

---

Next Steps

• How to Generate Baselines - Create your first baseline
• Tailoring a Baseline - Customize for your organization
• Baseline File Layout - Understand the YAML structure