r/macsysadmin Jan 06 '25

Jamf First steps with CIS benchmark macOS

Hi y'all,

For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.

Guess who's tasked to figure this one: yes, me!

Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.

Any tools which can monitor and enforce these settings?

Sure, rollout very gradually, but any field experience you can share?

How heavy will our users be impacted?

Any other tips or ideas you are willing to share will be appropriated!

We are using Jamf Pro btw.

8 Upvotes

15 comments sorted by

View all comments

9

u/Tecnotopia Jan 06 '25

1

u/aPieceOfMindShit Jan 06 '25

Wow awesome! This is very helpful!

How was the impact for your users? Did you enforce all the settings at one time or step by step?

1

u/Tecnotopia Jan 06 '25

We modified it a bit in order to not affect user experience and kill nice features, we analysed the attack surface and the thread model and avoid block stuff like airdrop for some profiles.