What Are Baselines?

A baseline is a YAML file that defines which security rules apply to your environment. Each baseline maps to a compliance framework (NIST 800-53, CIS Benchmarks, DISA STIG, etc.) and includes all the rules needed to meet that framework’s requirements.

Once you have a baseline, the project scripts use it to generate everything you need: guidance documents, configuration profiles, compliance scripts, and more.

Tip

Think of a baseline as a shopping list of security settings. Your organization, industry, or regulatory requirements determine which baseline you need.

---

How Baselines Work

mSCP 2.0 (Beta)

mSCP 2.0 is currently in Beta

mSCP 2.0 is under active development and should not be used in production. Please report any issues to the project. For production deployments, refer to mSCP 1.0.

1. Choose a framework — Pick the compliance standard you need (NIST, CIS, STIG, etc.)
2. Generate the baseline — Run ./mscp.py baseline -k BASELINE_NAME to create the YAML file
3. Customize if needed — Tailor the baseline to your organization’s requirements
4. Generate outputs — Use the baseline to create profiles, scripts, and documentation

mSCP 1.0

Always Use the Correct Branch

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

1. Choose a framework — Pick the compliance standard you need (NIST, CIS, STIG, etc.)
2. Generate the baseline — Run ./scripts/generate_baseline.py -k BASELINE_NAME to create the YAML file
3. Customize if needed — Tailor the baseline to your organization’s requirements
4. Generate outputs — Use the baseline to create profiles, scripts, and documentation

Each baseline is specific to an operating system (macOS, iOS/iPadOS, or visionOS) and compliance level (High, Moderate, Low, or Level 1/2 depending on the framework).

---

Available Baselines

Government Frameworks

Framework	Baseline Files
NIST 800-53 Rev 5	800-53r5_high, 800-53r5_moderate, 800-53r5_low, 800-53r5_privacy
NIST 800-171	800-171
DISA STIG	macOS: disa_stig iOS: ios_stig
CMMC 2.0	cmmc_lvl1, cmmc_lvl2
CNSSI 1253	cnssi-1253_high, cnssi-1253_moderate, cnssi-1253_low
NLM APGOV	nlmapgov_base, nlmapgov_plus

Industry Frameworks

Framework	Baseline Files
CIS Benchmarks (macOS)	cis_lvl1, cis_lvl2
CIS Benchmarks (iOS)	cis_lvl1_byod, cis_lvl2_byod cis_lvl1_enterprise, cis_lvl2_enterprise
CIS Controls v8	cisv8

International

Framework	Baseline Files
Indigo (iOS only)	indigo_base, indigo_high

Note

CIS Level 2 baselines include all Level 1 rules plus additional controls for higher security environments.

---

List Available Baselines

mSCP 2.0 (Beta)

mSCP 2.0 is currently in Beta

mSCP 2.0 is under active development and should not be used in production. Please report any issues to the project. For production deployments, refer to mSCP 1.0.

./mscp.py baseline -l

Example output:

Available keywords (tags and benchmarks):

Tags (applicable to all platforms):
  800-171
  800-53r5_high
  800-53r5_low
  800-53r5_moderate
  800-53r5_privacy
  cisv8
  cmmc_lvl1
  cmmc_lvl2
  cnssi-1253_high
  cnssi-1253_low
  cnssi-1253_moderate
  all_rules

Benchmarks (platform-specific):
  cis_lvl1 (Platforms: macOS)
  cis_lvl2 (Platforms: macOS)
  disa_stig (Platforms: macOS)
  nlmapgov_plus (Platforms: macOS)

mSCP 1.0

Always Use the Correct Branch

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

./scripts/generate_baseline.py -l

Example output:

800-53r5_high
800-53r5_moderate
800-53r5_low
800-171
cis_lvl1
cis_lvl2
cisv8
DISA-STIG
cmmc_lvl1
cmmc_lvl2
cnssi-1253_high
cnssi-1253_moderate
cnssi-1253_low
nlmapgov_base
nlmapgov_plus
all_rules

---

Key Concepts

Concept	Description
Purpose	Define what security settings your systems should have
Customization	Tailor baselines to fit your organization’s specific needs
Auditing	Provide evidence that systems meet compliance standards
Automation	Scripts can check and fix settings automatically
Maintenance	Updated with each macOS release and when frameworks change

---

Next Steps

• How to Generate Baselines — Create your first baseline
• Tailoring a Baseline — Customize for your organization
• Baseline File Layout — Understand the YAML structure