How to Generate Compliance Scripts

Compliance scripts are generated as part of the guidance output using the -s flag. The script reads your baseline and creates a zsh script ready for deployment.

Note

You need a baseline first. See How to Generate Baselines if you haven’t created one.

---

Generate a Compliance Script

mSCP 2.0 (Beta)

mSCP 2.0 is currently in Beta

mSCP 2.0 is under active development and should not be used in production. Please report any issues to the project. For production deployments, refer to mSCP 1.0.

1. Run the command

   ./mscp.py guidance custom/baselines/BASELINE_NAME.yaml -s

   Example:

   ./mscp.py guidance custom/baselines/800-53r5_moderate_macos_26.0.yaml -s

2. Find your files

   The -s flag generates the compliance script and audit plist. Guidance documents are also created by default.

   • Directorybuild/

     • Directory800-53r5_moderate_macos_26.0/

       • 800-53r5_moderate_macos_26.0_compliance.sh Compliance script
       • 800-53r5_moderate_macos_26.0.adoc AsciiDoc guidance
       • 800-53r5_moderate_macos_26.0.html HTML guidance
       • 800-53r5_moderate_macos_26.0.pdf PDF guidance
       • Directorypreferences/

         • org.800-53r5_moderate_macos_26.0.audit.plist

mSCP 1.0

Always Use the Correct Branch

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

1. Run the script

   ./scripts/generate_guidance.py -s baselines/BASELINE_NAME.yaml

   Example:

   ./scripts/generate_guidance.py -s baselines/800-53r5_moderate.yaml

2. Find your files

   The -s flag generates the compliance script and audit plist. Guidance documents are also created by default.

   • Directorybuild/

     • Directory800-53r5_moderate/

       • 800-53r5_moderate_compliance.sh Compliance script
       • 800-53r5_moderate.adoc AsciiDoc guidance
       • 800-53r5_moderate.html HTML guidance
       • 800-53r5_moderate.pdf PDF guidance
       • Directorypreferences/

         • org.800-53r5_moderate.audit.plist

---

Running the Script

Run with sudo for full access to system settings:

mSCP 2.0 (Beta)

mSCP 2.0 is currently in Beta

mSCP 2.0 is under active development and should not be used in production. Please report any issues to the project. For production deployments, refer to mSCP 1.0.

sudo ./build/800-53r5_moderate_macos_26.0/800-53r5_moderate_macos_26.0_compliance.sh

mSCP 1.0

Always Use the Correct Branch

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

sudo ./build/800-53r5_moderate/800-53r5_moderate_compliance.sh

Flag	Description
(no flags)	Interactive menu mode
--check	Run compliance checks without interaction
--fix	Run remediation commands without interaction
--cfc	Run check, fix, check sequence
--stats	Display statistics from last scan
--compliant	Report number of compliant checks
--non_compliant	Report number of non-compliant checks
--reset	Clear results for current baseline
--reset-all	Clear results for all mSCP baselines

Tip

The script must be run with zsh. Running with sh or bash will result in errors.

---

Runtime Output

When executed, the script creates:

File	Location
Audit plist	/Library/Preferences/org.BASELINE_NAME.audit.plist
Log file	/Library/Logs/BASELINE_NAME_baseline.log

---

Next Steps

• Compliance Script Layout — Understand the script structure
• What Are Compliance Scripts? — Learn more about compliance scripts