How to Generate Compliance Scripts

Compliance scripts are generated using the generate_guidance.py script with the -s flag. The script reads your baseline and creates a zsh script ready for deployment.

Note

You need a baseline first. See How to Generate Baselines if you haven’t created one.

Always Use the Correct Branch (mSCP 1.0)

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

mSCP 2.0 (currently in beta) will remove the per-branch requirement and introduce easier installation methods.

---

Generate a Compliance Script

1. Run the generation script

   ./scripts/generate_guidance.py -s baselines/BASELINE_NAME.yaml

   Example:

   ./scripts/generate_guidance.py -s baselines/800-53r5_moderate.yaml

2. Find your files

   The -s flag generates the compliance script and audit plist. Guidance documents are also created by default.

   • Directorybuild/

     • Directory800-53r5_moderate/

       • 800-53r5_moderate_compliance.sh - Compliance script
       • 800-53r5_moderate.adoc - AsciiDoc guidance
       • 800-53r5_moderate.html - HTML guidance
       • 800-53r5_moderate.pdf - PDF guidance
       • Directorypreferences/

         • org.800-53r5_moderate.audit.plist

---

Running the Script

Run with sudo for full access to system settings:

sudo ./build/BASELINE_NAME/BASELINE_NAME_compliance.sh

Flag	Description
(no flags)	Interactive menu mode
--check	Run compliance checks without interaction
--fix	Run remediation commands without interaction
--cfc	Run check, fix, check sequence
--stats	Display statistics from last scan
--compliant	Report number of compliant checks
--non_compliant	Report number of non-compliant checks
--reset	Clear results for current baseline
--reset-all	Clear results for all mSCP baselines

Tip

The script must be run with zsh. Running with sh or bash will result in errors.

---

Runtime Output

When executed, the script creates:

File	Location
Audit plist	/Library/Preferences/org.BASELINE_NAME.audit.plist
Log file	/Library/Logs/BASELINE_NAME_baseline.log

---

Next Steps

• Compliance Script Layout - Understand the script structure
• What Are Compliance Scripts? - Learn more about compliance scripts