10,000+Downloads

800+Security rules

150+GitHub stars

No Command Line Required

mSCP normally runs on scripts. MACE takes that hassle away, offering the official mSCP build engine alongside its own native engine for building compliance.

New baseline

All-in-One Workflow

Create, customize, build, audit, and document baselines in one app. 800+ rules from every supported macOS, iOS, and visionOS release in NIST's macOS Security Compliance Project.

.mobileconfig

✓✓✓

MDM-Ready Exports

Deploy straight to Jamf Pro, Workspace ONE, Intune, Iru, Fleet, Addigy, and more, or build mobileconfig, plist, DDM, and signed profiles locally for any MDM.

Built for the frameworks you answer to

CIS Level 1 & 2
NIST 800-53
DISA STIG
CMMC
NIST 800-171
CIS v8
CNSSI-1253
HICP
NL MAPGOV

See every baseline on the mSCP GitHub

See MACE in Action

Main Menu

Your compliance command center

See What MACE Produces

Real output from a real build.

Audit Report

Rule-by-rule pass and fail results with pass rate, severity, and compliance mapping, ready to hand to an auditor.

HTML PDF XLSX CSV JSON Markdown AsciiDoc

Compliance Documentation

Full baseline guide with rule discussions, check procedures, and remediation steps for every control.

HTML PDF XLSX CSV JSON Markdown AsciiDoc

* Every report is fully customizable. These are the default outputs.

kextload sudo PayloadUUID /usr/bin mobileconfig

800-53 DisableGuestAccount security FirewallEnabled networksetup

BlockedApplications Notarization DDM Gatekeeper maxFailedAttempts

mSCP Keychain ContentFilter kernel_task ScreenSharing

askForPassword AirDrop lockoutDuration ASM sudo

BlockedApplications spctl sandbox PrivacyPreferences /System/Library

SecureBoot FullDiskAccess 800-53 PayloadContent enabled

Camera Gatekeeper RemoveApplication payload idleTime

/usr/bin minLength Bootstrap DEP remediate

nvram sudo idleTime SecureEnclave CAC

RemoteManagement AllowedApplications PayloadUUID LDAP InternetSharing

nvram 800-171 xattr defaults com.apple.security

AppleSilicon DFU com.apple.SystemPolicy Sidecar ASM

AppNap SCEP SecureBoot mSCP TCC

quarantine com.apple.SystemPolicy Kerberos AppNap Entitlements

com.apple.mail Spotlight ARDAgent quarantine kextload

TCC allowed FaceID SecureBoot pwpolicy

Notarization historyCount PasswordPolicy RemoteLogin T2

UniversalControl IPSW codesign historyCount LoginwindowText

Gatekeeper com.apple.mail codesign dscl autopkg

PrinterSharing FileSharing minLength com.apple.security PowerNap

ScreenSharing CIS DFU enforced PrivacyPreferences

ARDAgent ContentFilter RemoveApplication loginwindow ManagedPreferences

GlobalPreferences PayloadUUID AppleSilicon com.apple.SystemPolicy SmartCard

PrivacyPreferences sandbox read munki autopkg

/Library/Preferences spctl BlockAllIncoming com.apple.screensaver ditto

kernel_task com.apple.SystemPolicy AuthorizationRight ScreenSharing SocketFilter

Ethernet TCC ActiveDirectory AirDrop VPN

VPN diskutil MRT T2 idleTime

VPP LoginItem maxFailedAttempts sandbox mobileconfig

TCC minLength SecureBoot nvram expirationDays

com.apple.security Firewall kernel_task DFU UniversalControl

osascript com.apple.loginwindow com.apple.finder profile /System/Library

expirationDays firmwarepasswd read Rosetta FirewallEnabled

SystemUIServer quarantine ContentFilter ASR ARDAgent

STIG Bluetooth InternetSharing MDM SSHEnabled

TouchID requireAlphanumeric VPN loginwindow SecureBoot

Continuity allowed TCC 800-171 STIG

Bootstrap quarantine plist PrinterSharing networksetup

SecureBoot requireAlphanumeric xattr PrinterSharing quarantine

networksetup SSO TCC xattr required

ASM SecureEnclave com.apple.security APFS com.apple.SystemPolicy

MACE chown kextunload enforced BlockedApplications

mobileconfig MRT AppleSilicon Firewall requireAlphanumeric

mobileconfig ConfigurationProfile PacketTunnel SecureEnclave FaceID

launchctl Hardened Runtime UniversalControl XProtect /Library/Preferences

com.apple.security PrivacyPreferences security csrutil autopkg

VPP WindowServer BluetoothSharing SecureEnclave com.apple.screensaver

ContentFilter SecKeychain BlockedApplications PowerNap true

SecKeychain FileSharing LDAP AuthorizationDB RemoteManagement

AllowedApplications AppleSilicon osascript UniversalControl sudo

AppleSilicon benchmark Ethernet com.apple.SystemPolicy DDM

DEP kextload 800-171 MACE SystemPolicy

dscl lockoutDuration csrutil scutil networksetup

TouchID SCEP idleTime autopkg com.apple.dock

STIG firmwarepasswd audit com.apple.TCC com.apple.dock

hdiutil StartupItem ASR chown pwpolicy

Firewall MACE munki nvram /var/db

NSGlobalDomain payload hdiutil TimeMachine jamf

idleTime remediate codesign /usr/bin autopkg

Ready to Simplify Apple Compliance?

Download MACE for free and start building your security baselines today.

Download MACE Read the Docs