How to Generate Compliance Scripts

Compliance scripts are generated as part of the guidance output using the -s flag. The script reads your baseline and creates a zsh script ready for deployment.

Note

You need a baseline first. See How to Generate Baselines if you haven’t created one.

---

Generate a Compliance Script

mSCP 2.0

1. Run the command

   ./mscp.py guidance custom/baselines/BASELINE_NAME.yaml -s

   Example:

   ./mscp.py guidance custom/baselines/800-53r5_moderate_macos_26.0.yaml -s

2. Find your files

   The -s flag generates the compliance script and audit plist. Guidance documents are also created by default.

   • Directorybuild/

     • Directory800-53r5_moderate_macos_26.0/

       • 800-53r5_moderate_macos_26.0_compliance.sh Compliance script
       • 800-53r5_moderate_macos_26.0.adoc AsciiDoc guidance
       • 800-53r5_moderate_macos_26.0.html HTML guidance
       • 800-53r5_moderate_macos_26.0.pdf PDF guidance
       • Directorypreferences/

         • org.800-53r5_moderate_macos_26.0.audit.plist

mSCP 1.0

Always Use the Correct Branch

The main branch is now used for mSCP 2.0 and will generate content using the mSCP 2.0 methods. For mSCP 1.0, each macOS version has its own branch (sequoia, sonoma, ventura, etc.) — check out the branch that matches your target OS.

1. Run the script

   ./scripts/generate_guidance.py -s baselines/BASELINE_NAME.yaml

   Example:

   ./scripts/generate_guidance.py -s baselines/800-53r5_moderate.yaml

2. Find your files

   The -s flag generates the compliance script and audit plist. Guidance documents are also created by default.

   • Directorybuild/

     • Directory800-53r5_moderate/

       • 800-53r5_moderate_compliance.sh Compliance script
       • 800-53r5_moderate.adoc AsciiDoc guidance
       • 800-53r5_moderate.html HTML guidance
       • 800-53r5_moderate.pdf PDF guidance
       • Directorypreferences/

         • org.800-53r5_moderate.audit.plist

---

Running the Script

Run with sudo for full access to system settings:

mSCP 2.0

sudo ./build/800-53r5_moderate_macos_26.0/800-53r5_moderate_macos_26.0_compliance.sh

mSCP 1.0

Always Use the Correct Branch

The main branch is now used for mSCP 2.0 and will generate content using the mSCP 2.0 methods. For mSCP 1.0, each macOS version has its own branch (sequoia, sonoma, ventura, etc.) — check out the branch that matches your target OS.

sudo ./build/800-53r5_moderate/800-53r5_moderate_compliance.sh

Flag	Description
(no flags)	Interactive menu mode
--check	Run compliance checks without interaction
--fix	Run remediation commands without interaction
--cfc	Run check, fix, check sequence
--stats	Display statistics from last scan
--compliant	Report number of compliant checks
--non_compliant	Report number of non-compliant checks
--reset	Clear results for current baseline
--reset-all	Clear results for all mSCP baselines

Tip

The script must be run with zsh. Running with sh or bash will result in errors.

---

Runtime Output

When executed, the script creates:

File	Location
Audit plist	/Library/Preferences/org.BASELINE_NAME.audit.plist
Log file	/Library/Logs/BASELINE_NAME_baseline.log

---

Next Steps

• Compliance Script Layout — Understand the script structure
• What Are Compliance Scripts? — Learn more about compliance scripts