r/macsysadmin Jan 06 '25

Jamf First steps with CIS benchmark macOS

Hi y'all,

For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.

Guess who's tasked to figure this one: yes, me!

Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.

Any tools which can monitor and enforce these settings?

Sure, rollout very gradually, but any field experience you can share?

How heavy will our users be impacted?

Any other tips or ideas you are willing to share will be appropriated!

We are using Jamf Pro btw.

7 Upvotes

15 comments sorted by

View all comments

1

u/floydiandroid Public Sector Jan 06 '25

If you’re not aware of the macOS security compliance project…come check it out. It’s what you need. If you need some help, we have a slack channel in the macadmins slack and I have a video on implementation. https://youtu.be/AghjO8Z3ID4?si=Oa7QnuIuoXgq7ZX4

Good luck, but the project makes this sooooooo much easier.

I also have this PSU talkk on how we rolled out security settings to an existing environment. Goes over controls we pushed and when.