Skip to content
mSCP

Rule File Layout

A rule file defines a single security control. Each rule is written in YAML and must follow the structure below.

Required Fields

Section titled “Required Fields”
FieldDescription
idUnique identifier matching the filename (without .yaml)
titleHuman-readable title for the rule
discussionDescription of the rule’s intent and context
referencesNested mappings to frameworks organized by source (nist, disa, cis)
platformsPer-OS, per-version enforcement info (check, fix, result, benchmarks)
tagsKeywords for categorizing and filtering rules

Optional Fields

Section titled “Optional Fields”
FieldDescription
odvOrganization Defined Values with hint and defaults
severitySeverity level (low, medium, high)
mobileconfigSet to true if enforceable via configuration profile
mobileconfig_infoConfiguration profile payload (required if mobileconfig is true)
ddm_infoDDM configuration declaration

References Structure

Section titled “References Structure”

References are nested by source organization:

references:
  nist:
    cce:
      macos_26: [CCE-95164-0]
      macos_15: [CCE-94164-1]
    800-53r5: [AC-3, CM-5, SI-7]
    800-171r3: [03.01.02, 03.04.05]
  disa:
    disa_stig:
      macos_26: [APPL-26-002064]
      macos_15: [APPL-15-002064]
    srg: [SRG-OS-000480-GPOS-00227]
  cis:
    cis: {benchmark: [N/A], controls_v8: [N/A]}

Example Rule File

Section titled “Example Rule File”
id: os_authenticated_root_enable
title: Enable Authenticated Root
discussion: |
  Authenticated Root _MUST_ be enabled.


  When Authenticated Root is enabled the macOS is booted from a
  signed volume that is cryptographically protected to prevent
  tampering with the system volume.
references:
  nist:
    cce:
      macos_26: [CCE-95164-0]
      macos_15: [CCE-94164-1]
      macos_14: [CCE-92764-0]
    800-53r5: [AC-3, CM-5, SC-34, SI-7]
    800-171r3: [03.01.02, 03.04.05]
  disa:
    disa_stig:
      macos_26: [APPL-26-002064]
      macos_15: [APPL-15-002064]
      macos_14: [APPL-14-002064]
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_moderate
platforms:
  macOS:
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: >
            /usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null |
            /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;"
          result:
            integer: 1
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: >
            /usr/bin/csrutil authenticated-root |
            /usr/bin/grep -c 'enabled'
          result:
            integer: 1
mobileconfig: false

Next Steps

Section titled “Next Steps”