12,000+Downloads

800+Security rules

160+GitHub stars

No Command Line Required

mSCP normally runs on scripts. MACE takes that hassle away, offering the official mSCP build engine alongside its own native engine for building compliance.

New baseline

All-in-One Workflow

Create, customize, build, audit, and document baselines in one app. 800+ rules from every supported macOS, iOS, and visionOS release in NIST's macOS Security Compliance Project.

.mobileconfig

✓✓✓

MDM-Ready Exports

Deploy straight to Jamf Pro, Workspace ONE, Intune, Iru, Fleet, Addigy, and more, or build mobileconfig, plist, DDM, and signed profiles locally for any MDM.

Built for the frameworks you answer to

CIS Level 1 & 2
NIST 800-53
DISA STIG
CMMC
NIST 800-171
CIS v8
CNSSI-1253
HICP
NL MAPGOV

See every baseline on the mSCP GitHub

See MACE in Action

Main Menu

Your compliance command center

See What MACE Produces

Real output from a real build.

Audit Report

Rule-by-rule pass and fail results with pass rate, severity, and compliance mapping, ready to hand to an auditor.

HTML PDF XLSX CSV JSON Markdown AsciiDoc

Compliance Documentation

Full baseline guide with rule discussions, check procedures, and remediation steps for every control.

HTML PDF XLSX CSV JSON Markdown AsciiDoc

* Every report is fully customizable. These are the default outputs.

com.apple.screensaver PIV translocation fdesetup scutil

FindMy enforced compliant ContentFilter mobileconfig

DEP ManagedPreferences MRT VPN ConfigurationProfile

AirDrop STIG SystemPolicy SecureBoot declaration

PrivacyPreferences RemoteLogin MACE LoginItem SAML

InternetSharing launchctl NSGlobalDomain write BlockAllIncoming

TCC ABM AirDrop write PrinterSharing

AppleSilicon LaunchDaemon xattr ApplicationFirewall FileSharing

AllowedApplications ContentFilter InstallApplication SmartCard Notarization

OpenDirectory security munki SystemPolicy hardening

MCX payload SystemPolicy STIG LoggingEnabled

UniversalControl StealthMode audit NIST baseline

quarantine idleTime BlockAllIncoming /Library/Preferences declaration

Accessibility RemoteLogin com.apple.Safari OIDC LaunchDaemon

historyCount RestrictedSoftware RemoveApplication ScreenSaverDelay defaults

800-171 800-53 Entitlements VPN remediate

OAuth AllowedApplications T2 DFU UniversalControl

jamf Keychain /usr/bin RestrictedSoftware ditto

benchmark Sidecar PlatformSSO SecureEnclave softwareupdate

com.apple.security scutil StealthMode security DisableGuestAccount

CMMC RemoteLogin Entitlements com.apple.Safari Gatekeeper

CMMC Notarization Gatekeeper SecureBoot PIV

jamf translocation CIS idleTime ASR

TCC SystemPolicy chown TimeMachine T2

PrivacyPreferences remediate Notarization false baseline

mobileconfig maxFailedAttempts SecKeychain RequirePassword SSO

AppleSilicon com.apple.Safari com.apple.screensaver Sidecar TCC

Notarization jamf diskutil kextload read

SecureEnclave Gatekeeper MACE scutil BluetoothSharing

audit com.apple.finder Handoff TouchID csrutil

Hardened Runtime IPSW FileSharing write defaults

SSHEnabled csrutil minLength systemsetup autopkg

profiles com.apple.Terminal PowerNap SecureEnclave SecureToken

BlockAllIncoming write hdiutil LoggingEnabled FileVault

AuthorizationRight SecureEnclave AppNap 800-171 nvram

Gatekeeper CAC ABM InternetSharing SecureEnclave

VPN minLength LaunchDaemon Hardened Runtime SocketFilter

Continuity DisableGuestAccount NSGlobalDomain compliant allowed

com.apple.finder SecKeychain AuthorizationDB CIS historyCount

BluetoothSharing InternetSharing AppleSilicon plist spctl

Notarization DEP PlistBuddy plist nvram

systemsetup DirectoryService chown LoggingEnabled APFS

SecKeychain WindowServer mSCP csrutil pwpolicy

SIP write /System/Library killall com.apple.loginwindow

security historyCount SSHEnabled write T2

Bootstrap sudo SystemPolicy APFS xattr

hdiutil iCloud quarantine 800-171 AuthorizationRight

Bluetooth IPSW com.apple.TCC T2 Ethernet

StartupItem AppleSilicon RemoveApplication PlatformSSO loginwindow

hardening sudo /usr/bin Entitlements mdmclient

maxFailedAttempts com.apple.TCC IPSW lockoutDuration /usr/bin

hardening WiFi pwpolicy StealthMode SmartCard

audit PasswordPolicy StartupItem lockoutDuration DisableGuestAccount

com.apple.security chmod expirationDays WiFi DDM

PIV com.apple.finder com.apple.Terminal chown requireAlphanumeric

sudo PayloadType MDM PasswordPolicy launchctl

800-171 softwareupdate false Keychain Gatekeeper

PrivacyPreferences SecureToken LoggingEnabled historyCount PIV

expirationDays DDM false osascript 800-171

disabled ScreenRecording Microphone compliant SystemPolicy

Ready to Simplify Apple Compliance?

Download MACE for free and start building your security baselines today.

Download MACE Read the Docs