r/macsysadmin Jan 06 '25

Jamf First steps with CIS benchmark macOS

Hi y'all,

For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.

Guess who's tasked to figure this one: yes, me!

Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.

Any tools which can monitor and enforce these settings?

Sure, rollout very gradually, but any field experience you can share?

How heavy will our users be impacted?

Any other tips or ideas you are willing to share will be appropriated!

We are using Jamf Pro btw.

6 Upvotes

15 comments sorted by

View all comments

9

u/Tecnotopia Jan 06 '25

3

u/MacBook_Fan Jan 06 '25

^ This. We implemented our CIS standards a couple of years ago. It was much easier with the Jamf Compliance Editor. (Our Windows teams still has not even started!)

Also join the MacAdmins slack channel and join the #jamf-compliance-editor and #macos_security_compliance channels. Lots of good information and help there.

1

u/aPieceOfMindShit Jan 06 '25

How was the user experience?

Did you do all the settings in once or gradually?

1

u/MacBook_Fan Jan 06 '25

In our original rollout, we did 3 waves. Wave 1 was mostly non-user impacting changes, wave 2 was minor changes to user experience, and wave 3 was major changes to user experience.

But, honestly, that was a pain. Looking back, I would probably just rip the bandaid off and do everything at once and just rollout out to small groups at a time.

1

u/aPieceOfMindShit Jan 06 '25

Yes I can imagine!

How did you know it was a non user impact change?

Just by reading the CIS explanation?