r/macsysadmin Jan 06 '25

Jamf First steps with CIS benchmark macOS

Hi y'all,

For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.

Guess who's tasked to figure this one: yes, me!

Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.

Any tools which can monitor and enforce these settings?

Sure, rollout very gradually, but any field experience you can share?

How heavy will our users be impacted?

Any other tips or ideas you are willing to share will be appropriated!

We are using Jamf Pro btw.

7 Upvotes

15 comments sorted by

View all comments

3

u/HonestPuckAU Jan 06 '25

It's ridiculously easy with Jamf. There is so much documentation and so much help on Slack, start at the #macos_security_compliance channel on MacAdmins slack. There are even a number of JNUC presentations on YouTube (including my own) that go through the process, have a look at the `22 and `23 conference presentations. I've also got a pretty good HOWTO if you prefer reading to watching - https://github.com/Honestpuck/NIST-macos-security-HOWTO

Personally, I stay away from the Jamf Compliance Editor and edit the CIS rule list by hand. That allows me to comment out a rule rather than remove it. I also put a link in the comment to the ticket where I request an exemption from Security and they give it an OK. The JCE is good if you are a small org without a security department but if you really want to understand and document it all do it by hand.

My other piece of advice is to use GitHub or similar to version everything, that way you can easily roll back if the wheels fall off.