Skip to content
mSCP

Rule File Layout

A rule file defines a single security control. Each rule is written in YAML and must follow the structure below.

Required Fields

Section titled “Required Fields”
Field Description
id Unique identifier matching the filename (without .yaml)
title Human-readable title for the rule
discussion Description of the rule’s intent and context
references Nested mappings to frameworks organized by source (nist, disa, cis)
platforms Per-OS, per-version enforcement info (check, fix, result, benchmarks)
tags Keywords for categorizing and filtering rules

Optional Fields

Section titled “Optional Fields”
Field Description
odv Organization Defined Values with hint and defaults
severity Severity level (low, medium, high)
mobileconfig Set to true if enforceable via configuration profile
mobileconfig_info Configuration profile payload (required if mobileconfig is true)
ddm_info DDM configuration declaration

References Structure

Section titled “References Structure”

References are nested by source organization:

references:
  nist:
    cce:
      macos_26: [CCE-95164-0]
      macos_15: [CCE-94164-1]
    800-53r5: [AC-3, CM-5, SI-7]
    800-171r3: [03.01.02, 03.04.05]
  disa:
    disa_stig:
      macos_26: [APPL-26-002064]
      macos_15: [APPL-15-002064]
    srg: [SRG-OS-000480-GPOS-00227]
  cis:
    cis: {benchmark: [N/A], controls_v8: [N/A]}

Example Rule File

Section titled “Example Rule File”
id: os_authenticated_root_enable
title: Enable Authenticated Root
discussion: |
  Authenticated Root _MUST_ be enabled.


  When Authenticated Root is enabled the macOS is booted from a
  signed volume that is cryptographically protected to prevent
  tampering with the system volume.
references:
  nist:
    cce:
      macos_26: [CCE-95164-0]
      macos_15: [CCE-94164-1]
      macos_14: [CCE-92764-0]
    800-53r5: [AC-3, CM-5, SC-34, SI-7]
    800-171r3: [03.01.02, 03.04.05]
  disa:
    disa_stig:
      macos_26: [APPL-26-002064]
      macos_15: [APPL-15-002064]
      macos_14: [APPL-14-002064]
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_moderate
platforms:
  macOS:
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: >
            /usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null |
            /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;"
          result:
            integer: 1
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
      enforcement_info:
        check:
          shell: >
            /usr/bin/csrutil authenticated-root |
            /usr/bin/grep -c 'enabled'
          result:
            integer: 1
mobileconfig: false

Next Steps

Section titled “Next Steps”