Check your readiness
Operating system · Apple

macOS settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to macOS 26 (Tahoe) and macOS 15 (Sequoia) (paths checked against Apple Support).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A Mac meets Cyber Essentials when the built-in firewall is on, unused sharing services and the Guest account are off, the screen locks and requires a password, Software Update installs macOS and security responses automatically, the daily account is not an administrator, and anti-malware software is active or app installs are limited to an approved list. FileVault is not required.

Key facts
Platform
macOS (Apple)
Applies to
macOS 26 (Tahoe) and macOS 15 (Sequoia) (paths checked against Apple Support)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
23 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure macOS for firewalls?

Apply 3 settings in macOS: turn on the firewall, restrict incoming connections and enable stealth mode and verify from Terminal for evidence. Together they provide evidence for A4.1.1 and A4.7.

macOS ships with an application firewall that is off by default. Turn it on and block incoming connections you do not need. See the firewalls requirements for what the control asks.

  1. Turn on the firewall

    A4.1.1
    System Settings > Network > Firewall > Firewall: On

  2. Restrict incoming connections and enable stealth mode

    A4.7
    System Settings > Network > Firewall > Options > Block all incoming connections (if practical) or review the allowed list; Enable stealth mode: On

    Consider turning off Automatically allow downloaded signed software to receive incoming connections.

  3. Verify from Terminal for evidence

    A4.1.1
    Terminal: /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate (expect: Firewall is enabled)

A5: how do you configure macOS for secure configuration?

Apply 5 settings in macOS: turn off the Guest account and automatic login, disable unused sharing services, stop Safari opening downloaded files, require a password when the screen locks and use Touch ID or a password of at least 6 characters. Together they provide evidence for A5.2, A5.9, A5.1, A5.8 and A5.10.

Sharing services, the Guest account and Safari's auto-open behaviour are the settings assessors ask about. See the secure configuration requirements for what the control asks.

  1. Turn off the Guest account and automatic login

    A5.2A5.9
    System Settings > Users & Groups > Guest User > Allow guests to log in to this computer: Off; Automatically log in as: Off

  2. Disable unused sharing services

    A5.1
    System Settings > General > Sharing > Screen Sharing, File Sharing, Remote Login, Remote Management, Media Sharing: Off unless there is a documented need

  3. Stop Safari opening downloaded files

    A5.8
    Safari > Settings > General > Open "safe" files after downloading: Off

  4. Require a password when the screen locks

    A5.9
    System Settings > Lock Screen > Require password after screen saver begins or display is turned off: Immediately (or After 5 seconds); Turn display off on battery when inactive and Turn display off on power adapter when inactive: 10 minutes or less

  5. Use Touch ID or a password of at least 6 characters

    A5.10
    System Settings > Touch ID & Password; enforce length with an MDM Passcode payload (Minimum length: 6, or 12 if the same credential is used for network sign-in)

A6: how do you configure macOS for security update management?

Apply 5 settings in macOS: confirm the version is in support, turn on all automatic updates, auto-update App Store apps, auto-update Microsoft and other third-party apps and record the update schedule from Terminal. Together they provide evidence for A6.1, A2.6, A6.4.1, A6.5.1, A6.5, A6.5.2 and A6.4.2.

Apple publishes no end-of-support dates for macOS. In practice it patches the current release and the two before it; on 26 October 2026 it shipped security updates for macOS 27, 26 and 15, while Sonoma 14 last received one on 6 August 2026. Automatic updates cover the OS, App Store apps and security responses. See the security update management requirements for what the control asks.

  1. Confirm the version is in support

    A6.1A2.6
    Apple menu > About This Mac > macOS (as of November 2026: macOS 27, 26 or 15; check the version appears on Apple's security releases page within recent months)

  2. Turn on all automatic updates

    A6.4.1A6.5.1
    System Settings > General > Software Update > Automatic Updates (i) > Download new updates when available, Install macOS updates, Install Security Responses and system files: all On

  3. Auto-update App Store apps

    A6.5.1
    App Store > App Store menu > Settings > Automatic Updates: On

  4. Auto-update Microsoft and other third-party apps

    A6.5AUTO-FAILA6.5.2
    Any Microsoft app > Help > Check for Updates > Microsoft AutoUpdate > Automatically keep Microsoft Apps up to date: On; repeat for Chrome (chrome://settings/help), Zoom, Adobe and similar

  5. Record the update schedule from Terminal

    A6.4.2
    Terminal: softwareupdate --list (an empty list means no updates are waiting; keep the dated output as evidence)

A7: how do you configure macOS for user access control?

Apply 5 settings in macOS: make the daily account a standard user, set lockout after 10 failed attempts, set the minimum password length, provide a password manager and remove leavers' accounts. Together they provide evidence for A7.6, A7.7, A7.10, A7.11, A7.12 and A7.3.

macOS creates the first account as an administrator. Cyber Essentials needs the daily account to be standard, with a separate admin account for changes. See the user access control requirements for what the control asks.

  1. Make the daily account a standard user

    A7.6A7.7
    System Settings > Users & Groups > select the account > (i) > Allow this user to administer this computer: Off (create a separate admin account first)

  2. Set lockout after 10 failed attempts

    A7.10
    MDM Passcode payload > Maximum Number of Failed Attempts: 10; or Terminal: pwpolicy -setaccountpolicies with policyAttributeMaximumFailedAuthentications = 10

  3. Set the minimum password length

    A7.11
    MDM Passcode payload > Minimum Passcode Length: 12 (or 8 where MFA protects the same account); change via System Settings > Users & Groups > Change Password

  4. Provide a password manager

    A7.12
    System Settings > Apple Account > iCloud > Passwords: On (Passwords app), or deploy the organisation's password manager

  5. Remove leavers' accounts

    A7.3
    System Settings > Users & Groups > select the account > remove (minus) > Delete the home folder

A8: how do you configure macOS for malware protection?

Apply 5 settings in macOS: restrict apps to signed sources, keep XProtect updating, deploy anti-malware if using option A, warn on fraudulent websites and deploy approved apps through MDM. Together they provide evidence for A8.4, A8.2, A8.1, A8.3 and A8.5.

Gatekeeper, XProtect and notarisation enforce code signing, which is only part of option B: you also need an approved app list. Most organisations use an anti-malware product (option A) instead. See the malware protection requirements for what the control asks.

  1. Restrict apps to signed sources

    A8.4
    System Settings > Privacy & Security > Security > Allow applications from: App Store, or App Store and Known Developers

    Gatekeeper blocks unsigned apps, which is half of option B. The other half is an approved list: users must only install apps you have approved (A8.5), which on a Mac usually means an MDM catalogue and standard user accounts.

  2. Keep XProtect updating

    A8.2
    System Settings > General > Software Update > Automatic Updates (i) > Install Security Responses and system files: On

  3. Deploy anti-malware if using option A

    A8.1A8.2A8.3
    Microsoft Defender for Endpoint on Mac (or equivalent) > Real-time protection: On; System Settings > General > Login Items & Extensions > Network Extensions: allow the product's extension

  4. Warn on fraudulent websites

    A8.3
    Safari > Settings > Security > Warn when visiting a fraudulent website: On

  5. Deploy approved apps through MDM

    A8.5
    Apple Business (formerly Apple Business Manager) > Apps and Books > assign to your MDM; users install only from the managed app catalogue

Which questions does this guide cover?

The 25 questions below are the ones macOS can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.6Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.A6: Confirm the version is in support
A4.1.1Do you have software firewalls enabled on all of your computers, laptops and servers?A4: Turn on the firewall; A4: Verify from Terminal for evidence
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Restrict incoming connections and enable stealth mode
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Disable unused sharing services
A5.10Which method do you use to unlock the devices?A5: Use Touch ID or a password of at least 6 characters
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Turn off the Guest account and automatic login
A5.8Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?A5: Stop Safari opening downloaded files
A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?A5: Turn off the Guest account and automatic login; A5: Require a password when the screen locks
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Confirm the version is in support
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Turn on all automatic updates
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Record the update schedule from Terminal
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Auto-update Microsoft and other third-party apps
A6.5.1Are all updates applied on your applications by enabling auto updates?A6: Turn on all automatic updates; A6: Auto-update App Store apps
A6.5.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?A6: Auto-update Microsoft and other third-party apps
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Set lockout after 10 failed attempts
A7.11Which technical controls are used to manage the quality of your passwords within your organisation?A7: Set the minimum password length
A7.12Please explain how you encourage people to use unique and strong passwords.A7: Provide a password manager
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A7: Remove leavers' accounts
A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?A7: Make the daily account a standard user
A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?A7: Make the daily account a standard user
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Deploy anti-malware if using option A
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Keep XProtect updating; A8: Deploy anti-malware if using option A
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Deploy anti-malware if using option A; A8: Warn on fraudulent websites
A8.4If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?A8: Restrict apps to signed sources
A8.5If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?A8: Deploy approved apps through MDM

What evidence should you keep for the assessor?

Keep the 6 dated records listed below for macOS. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Screenshot of System Settings > Network > Firewall showing On.
  • Screenshot of About This Mac with the macOS version.
  • Screenshot of Software Update > Automatic Updates with every option on.
  • Screenshot of Users & Groups showing the daily account as Standard.
  • Screenshot of Privacy & Security > Allow applications from, or the third-party anti-malware console.
  • Output of socketfilterfw --getglobalstate and softwareupdate --list.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

No. Encryption is not a Cyber Essentials requirement. What is required is that the device locks and needs a credential to unlock (A5.9 and A5.10). Turn FileVault on anyway for data protection, but it does not affect the assessment.

Not on its own. Requirements v3.3 define application allow listing as code signing plus an actively approved list of applications that users cannot go beyond. Gatekeeper enforces signing, but any identified developer's app can run, so you also need MDM-controlled installs and standard user accounts to claim option B. Most organisations choose option A: an anti-malware product such as Defender for Endpoint, which also evidences A8.2 and A8.3.

Apple does not publish end-of-support dates, so check its security releases page. As of November 2026, macOS 27 (Golden Gate), macOS 26 (Tahoe) and macOS 15 (Sequoia) all received security updates on 26 October 2026. macOS 14 (Sonoma) last received one on 6 August 2026 and should be treated as unsupported for A6.1. A Mac that cannot run macOS 15 or later needs replacing.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources