Tailoring Rules

Tailoring lets you create a customized baseline by choosing which rules to include and setting organization-defined values (ODVs). This is different from customizing individual rules.

Note

Organization Defined Values (ODVs) are values you set to meet your organization’s security and functional requirements. The project includes recommended values, plus values from DISA STIG and CIS Benchmarks.

Always Use the Correct Branch (mSCP 1.0)

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

mSCP 2.0 (currently in beta) will remove the per-branch requirement and introduce easier installation methods.

---

Tailor a Baseline

1. Run the tailoring wizard

   ./scripts/generate_baseline.py -k BASELINE -t

   Example:

   ./scripts/generate_baseline.py -k 800-53r5_moderate -t

2. Enter your organization details

   Enter a name for your tailored benchmark: MyOrgs_Benchmark
   Enter your name: Your Name
   Enter your organization: Your Org

3. Choose rules to include

   For each rule, you’ll be prompted:

   Would you like to include the rule for "audit_acls_files_configure"? [Y/n/all/?]:

   Option	Description
   Y	Include this rule
   n	Skip this rule
   all	Include all remaining rules
   ?	Show rule details

4. Set ODV values

   For rules with ODVs, enter your value or press Enter for the default:

   Enter the ODV for "pwpolicy_account_lockout_enforce" or press Enter for the recommended value (3):

5. Find your files

   Output	Location
   Tailored baseline	build/baselines/MyOrgs_Benchmark.yaml
   Custom ODV rules	custom/rules/*.yaml

---

Generate from Tailored Baseline

After tailoring, generate your outputs:

./scripts/generate_guidance.py build/baselines/MyOrgs_Benchmark.yaml -p -s

---

Custom Rule File Format

When you set custom ODV values, the project creates a YAML file for each tailored rule:

---
odv:
  custom: 11

These files are stored in custom/rules/ and contain only your custom values.

---

Next Steps

• Customize Rules - Modify rule behavior beyond ODVs
• Exempting Rules - Exclude rules from compliance checks