Tailoring Rules

Tailoring lets you create a customized baseline by choosing which rules to include and setting organization-defined values (ODVs). This is different from customizing individual rules.

Note

Organization Defined Values (ODVs) are values you set to meet your organization’s security and functional requirements. The project includes recommended values, plus values from DISA STIG and CIS Benchmarks.

---

Tailor a Baseline

mSCP 2.0

1. Run the tailoring wizard

   ./mscp.py baseline -k BASELINE -t

   Example:

   ./mscp.py baseline -k 800-53r5_moderate -t

2. Enter your organization details

   Enter a name for your tailored benchmark: MyOrgs_Benchmark
   Enter your name: Your Name
   Enter your organization: Your Org

3. Choose rules to include

   For each rule, you’ll be prompted:

   Would you like to include the rule for "audit_acls_files_configure"? [Y/n/all/?]:

   Option	Description
   Y	Include this rule
   n	Skip this rule
   all	Include all remaining rules
   ?	Show rule details

4. Set ODV values

   For rules with ODVs, enter your value or press Enter for the default:

   Enter the ODV for "pwpolicy_account_lockout_enforce" or press Enter for the recommended value (3):

5. Find your files

   Output	Location
   Tailored baseline	custom/baselines/MyOrgs_Benchmark_macos_26.0.yaml
   Custom ODV rules	custom/rules/*.yaml

mSCP 1.0

Always Use the Correct Branch

The main branch is now used for mSCP 2.0 and will generate content using the mSCP 2.0 methods. For mSCP 1.0, each macOS version has its own branch (sequoia, sonoma, ventura, etc.) — check out the branch that matches your target OS.

1. Run the tailoring wizard

   ./scripts/generate_baseline.py -k BASELINE -t

   Example:

   ./scripts/generate_baseline.py -k 800-53r5_moderate -t

2. Enter your organization details

   Enter a name for your tailored benchmark: MyOrgs_Benchmark
   Enter your name: Your Name
   Enter your organization: Your Org

3. Choose rules to include

   For each rule, you’ll be prompted:

   Would you like to include the rule for "audit_acls_files_configure"? [Y/n/all/?]:

   Option	Description
   Y	Include this rule
   n	Skip this rule
   all	Include all remaining rules
   ?	Show rule details

4. Set ODV values

   For rules with ODVs, enter your value or press Enter for the default:

   Enter the ODV for "pwpolicy_account_lockout_enforce" or press Enter for the recommended value (3):

5. Find your files

   Output	Location
   Tailored baseline	build/baselines/MyOrgs_Benchmark.yaml
   Custom ODV rules	custom/rules/*.yaml

---

Generate from Tailored Baseline

mSCP 2.0

./mscp.py guidance custom/baselines/MyOrgs_Benchmark_macos_26.0.yaml -A

mSCP 1.0

Always Use the Correct Branch

The main branch is now used for mSCP 2.0 and will generate content using the mSCP 2.0 methods. For mSCP 1.0, each macOS version has its own branch (sequoia, sonoma, ventura, etc.) — check out the branch that matches your target OS.

./scripts/generate_guidance.py build/baselines/MyOrgs_Benchmark.yaml -p -s

---

Custom Rule File Format

When you set custom ODV values, the project creates a YAML file for each tailored rule:

---
odv:
  custom: 11

These files are stored in custom/rules/ and contain only your custom values.

---

Next Steps

• Customize Rules — Modify rule behavior beyond ODVs
• Exempting Rules — Exclude rules from compliance checks