Getting Started

Decide which version to set up with, then follow the steps below.

mSCP 2.0 (Beta)

The newest version, runs in a container or locally (with dependencies), supports all macOS/iOS/visionOS versions in one place without switching branches.

mSCP 1.0

The stable release, runs locally (with dependencies), uses separate branches for each macOS/iOS/visionOS version and requires switching branches to change versions.

Setup

mSCP 2.0 (Beta)

mSCP 2.0 is currently in Beta

mSCP 2.0 is under active development and should not be used in production. Please report any issues to the project. For production deployments, refer to mSCP 1.0.

Container (Recommended)

Requirements:

• A container solution is required:
  • Apple Container (Recommended)
  • Docker

1. Create Local Folders

   mkdir -p ~/Desktop/mscp/custom

2. Run the Container

   Using Apple Container:

   container run -it \
     --volume ~/Desktop/mscp:/mscp/build \
     --volume ~/Desktop/mscp/custom:/mscp/custom \
     ghcr.io/usnistgov/macos_security:latest

   Apple Container commands Click to expand

   Start the container service (required before first run):

   container system start

   Exit the container:

   exit

   Stop the container service:

   container system stop

   Check container service status:

   container system status

   Or Using Docker:

   # Note: Docker requires full paths for volume mounts
   docker run -it \
     --volume /Users/<username>/Desktop/mscp:/mscp/build \
     --volume /Users/<username>/Desktop/mscp/custom:/mscp/custom \
     ghcr.io/usnistgov/macos_security:latest

3. Generate Content

   config/custom/baselines/cis_lvl1_macos_26.0.yaml

   # Create a baseline
   ./mscp.py baseline -k cis_lvl1
   # Generate guidance with all outputs
   ./mscp.py guidance custom/baselines/cis_lvl1_macos_26.0.yaml -A
   # Output: MSCP DOCUMENT GENERATION COMPLETE! All documents in: /build/cis_lvl1_macos_26.0/

Manual Method (Optional)

Manual setup with Python and Ruby.

Requirements:

• Python >= 3.14
  • Recommended: Macadmins Python
• Ruby >= 3.4.4

1. Clone the Repository

   git clone -b dev_2.0 https://github.com/usnistgov/macos_security.git
   cd macos_security

2. Python Setup

   # Create virtual environment
   python3 -m venv .venv
   source .venv/bin/activate
   
   # Update and install tools
   python3 -m pip install --upgrade pip setuptools wheel
   python3 -m pip install --upgrade -r requirements.txt

3. Ruby Setup

   bundle config path mscp_gems
   bundle config bin mscp_gems/bin
   bundle install
   bundle binstubs --all

4. Generate Content

   # Create a baseline
   ./mscp.py baseline -k cis_lvl1
   
   # Generate guidance with all outputs
   ./mscp.py guidance custom/baselines/cis_lvl1_macos_26.0.yaml -A
   
   # When done, deactivate the virtual environment
   deactivate

mSCP 1.0

Always Use the Correct Branch

Each macOS version has its own branch (sequoia, sonoma, ventura, etc.). Never use the main branch — it won’t work for generating content.

Requirements:

• Python >= 3.12.1 (3.14 is not supported)
  • Recommended: Macadmins Python
• Ruby >= 3.4.4 (optional — for PDF output)

1. Clone the Repository

   git clone https://github.com/usnistgov/macos_security.git
   cd macos_security
   git checkout sequoia

   Replace sequoia with your target macOS version (sequoia, sonoma, ventura, etc.).

   Prefer to download a ZIP? Click to expand

   1. Go to the GitHub repository
   2. Click the branch dropdown and select your macOS version
   3. Click Code → Download ZIP
   4. Extract and open the folder

2. Python Setup

   # Create virtual environment
   python3 -m venv .venv
   source .venv/bin/activate
   
   # Install requirements
   pip3 install -r requirements.txt

   Having Python version issues? Click to expand

   Check your Python version:

   python3 --version

   Check version inside the venv:

   source .venv/bin/activate
   python --version

   List all installed Python versions:

   ls /opt/homebrew/bin/python3*
   ls /usr/local/bin/python3*

   Create venv with a specific version:

   # Remove old venv if needed
   rm -rf .venv
   
   # Use full path to the Python version you want
   /opt/homebrew/bin/python3.13 -m venv .venv
   source .venv/bin/activate

3. Ruby Setup (Optional — for PDF output)

   bundle install --binstubs --path mscp_gems

4. Verify Setup

   Run this command to confirm everything works:

   ./scripts/generate_baseline.py -l
   
   # When done, deactivate the virtual environment
   deactivate

   You should see a list of available baselines.

---

What You Can Do

With the project set up, you can:

• Generate baselines — Create YAML files for security frameworks (NIST, CIS, DISA STIG, etc.)
• Generate guidance — Produce HTML/PDF documentation for your baseline
• Create configuration profiles — Deploy settings via MDM
• Run compliance checks — Scan Macs against your baseline
• Customize rules — Tailor settings to your organization’s needs

---

Next Steps

Quick Guide Step-by-step workflow for generating security compliance files.

Or explore specific topics:

• How to Generate Baselines
• How to Generate Guidance
• How to Generate Configuration Profiles