# MacLockdown Security Report

| | |
|---|---|
| **Generated** | 2026-03-17 12:37:08 |
| **Host** | MacBook Pro de JeeyDee |
| **macOS** | Version 26.3 (Build 25D125) |
| **Score** | 100/100 |
| **Failed** | 0 |
| **Passed** | 36 |
| **Unverified** | 3 |
| **Ignored (failing)** | 0 |
| **Ignored (passing)** | 0 |

## Posture Evolution Since Last Scan

| Metric | Value |
|---|---|
| Previous score | 93/100 |
| Current score | 100/100 |
| Score delta | +7 |
| Risk trend | Decreasing |
| Controls improved | 2 |
| Controls regressed | 0 |
| New risks introduced | 0 |

Security posture improved since the last scan.

### Controls improved

- Firewall
- Stealth Mode

---

> ℹ️ **Partially verified:** 3 check(s) could not be verified on this macOS version and were excluded from the score.

---

## ✅ Passed (36)

### 1. System Integrity Protection
**Level:** Crítico · **Weight:** weight 10 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 5.1.5 · Apple Apple Security SIP

**What it does:** Prevents any process — even root — from modifying protected system files, directories, and kernel extensions.

**Why it matters:** Malware with root access can persist indefinitely if SIP is disabled. It is the last line of defense against kernel-level attacks.

### 2. Gatekeeper
**Level:** Higiénico · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 2.5.1 · NIST NIST SI-7

**What it does:** Verifies that apps are signed by an identified Apple developer and have passed notarization before running.

**Why it matters:** Without Gatekeeper, any unsigned app can run silently. Most macOS malware distributed via phishing relies on Gatekeeper being disabled.

### 3. Automatic updates
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 1.1 · NIST NIST SI-2 · PCI DSS PCI DSS 6.3.3

**What it does:** Enables automatic download and installation of macOS security updates and system data files.

**Why it matters:** Most real-world attacks exploit known vulnerabilities. Unpatched systems are the easiest targets — patches exist but were never applied.

### 4. Secure Token enabled
**Level:** Crítico · **Weight:** informational · **Profiles:** hardened, paranoid
**Frameworks:** Apple Apple SecureToken · NIST NIST IA-5

**What it does:** Verifies that the current user account has a Secure Token, which is required for FileVault encryption and recovery key generation.

**Why it matters:** Without Secure Token, a user cannot unlock FileVault or perform cryptographic operations. Accounts without it are effectively excluded from disk encryption recovery.

### 5. FileVault
**Level:** Higiénico · **Weight:** weight 10 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 2.6.1 · NIST NIST SC-28 · PCI DSS PCI DSS 3.5.1

**What it does:** Encrypts the entire startup disk using XTS-AES-128 encryption with a 256-bit key.

**Why it matters:** If your Mac is lost or stolen, anyone can remove the drive and read your files without encryption. FileVault makes this impossible.

### 6. Auto login disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 2.7.3 · NIST NIST IA-2

**What it does:** Verifies that automatic login is not configured — the Mac requires a password every time it boots or wakes from a full shutdown.

**Why it matters:** Auto login bypasses the login screen entirely. Anyone who powers on your Mac gets immediate access to your session without entering a password.

### 7. Screen password
**Level:** Higiénico · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 2.4.3 · NIST NIST AC-11 · PCI DSS PCI DSS 8.2.8

**What it does:** Configures macOS to require the user password immediately when the screen lock or screensaver activates.

**Why it matters:** Without screen lock, anyone with physical access to your Mac — even briefly — can access all your data and credentials.

### 8. Firewall
**Level:** Higiénico · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 3.4 · NIST NIST SC-7 · PCI DSS PCI DSS 1.4.1

**What it does:** Activates macOS native firewall to filter incoming network connections per application.

**Why it matters:** Without a firewall, any app can accept incoming connections. Attackers on the same network can reach services running on your Mac.

### 9. Stealth Mode
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 3.5 · NIST NIST SC-7

**What it does:** Enables firewall stealth mode so the Mac does not respond to ICMP ping requests or connection attempts on closed ports.

**Why it matters:** Without stealth mode, your Mac actively responds to network probes, making it visible and enumerable to attackers scanning the network.

### 10. Remote Login (SSH)
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.1 · NIST NIST AC-17 · PCI DSS PCI DSS 2.2.2

**What it does:** Checks whether SSH remote login is enabled. If active and not needed, disables the SSH daemon.

**Why it matters:** An exposed SSH port is one of the most common attack vectors. Brute force and credential stuffing rely on SSH being reachable.

### 11. File Sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.3

**What it does:** Checks that the SMB file sharing daemon is not running. If active, disables it.

**Why it matters:** File sharing exposes your Mac to SMB exploits and allows unauthenticated enumeration of shared resources on the network.

### 12. Printer Sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.4

**What it does:** Disables printer sharing via CUPS so local printers are not advertised or accessible over the network.

**Why it matters:** Shared printers expose an unnecessary network service that can be exploited for information disclosure or lateral movement.

### 13. Remote Apple Events disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.6

**What it does:** Ensures the Apple Events server is not running, preventing remote applications from sending commands to your Mac via AppleScript.

**Why it matters:** Remote Apple Events can be used to automate and control apps on your Mac from another machine — a significant attack vector if left open.

### 14. Screen Sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.2

**What it does:** Verifies that the screen sharing daemon (VNC) is not running. If active, disables it.

**Why it matters:** Screen sharing exposes full graphical control of your Mac over the network. A compromised credential means complete system takeover.

### 15. AirDrop limited
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.4.11

**What it does:** Checks AirDrop discoverability mode. Hardened requires it set to Off or Contacts Only — not Everyone.

**Why it matters:** AirDrop set to Everyone allows any nearby Apple device to send files to your Mac without authentication — a vector for malware delivery.

### 16. Internet Sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.7

**What it does:** Verifies that Internet Sharing is not active — your Mac is not routing its connection to other devices.

**Why it matters:** Internet Sharing turns your Mac into a router, creating a secondary network that bypasses corporate or home firewall controls.

### 17. Wake on Network disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.9

**What it does:** Disables Wake on Network (WoL) so the Mac does not power on in response to network packets.

**Why it matters:** Wake on Network can be exploited to remotely power on a Mac and access it before security controls are active.

### 18. Guest User Disabled
**Level:** Higiénico · **Weight:** weight 2 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.7.1 · PCI DSS PCI DSS 8.2.2

**What it does:** Disables the built-in Guest account that allows anyone to use the Mac without a password.

**Why it matters:** The Guest account provides Safari and partial file system access without authentication. It can be exploited for local privilege escalation.

### 19. Ad personalization disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** NIST NIST PT-8 · Apple Apple Privacy

**What it does:** Disables Apple's personalized advertising system, preventing your usage data from being used for ad targeting across Apple services.

**Why it matters:** Personalized advertising requires Apple to build and maintain a behavioral profile of your activity across apps and services.

### 20. Siri analytics off
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** NIST NIST PT-1 · Apple Apple Privacy

**What it does:** Sets Siri data sharing opt-in status to opted-out (value 2), preventing Siri interactions from being sent to Apple for analysis.

**Why it matters:** Siri analytics includes audio snippets and query content. Apple has contractors who listen to Siri recordings for quality review.

### 21. XProtect up to date
**Level:** Crítico · **Weight:** informational · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 1.2 · Apple Apple XProtect · PCI DSS PCI DSS 5.2.1

**What it does:** Verifies that XProtect, macOS's built-in malware detection engine, has current signature definitions. XProtect silently scans files when they are opened or downloaded.

**Why it matters:** Outdated signatures mean new malware variants go undetected. XProtect is the last passive line of defense for users who don't run third-party AV.

### 22. MRT active
**Level:** Crítico · **Weight:** informational · **Profiles:** hardened, paranoid
**Frameworks:** Apple Apple MRT · PCI DSS PCI DSS 5.2.1

**What it does:** Checks that the Malware Removal Tool (MRT) binary is present. MRT runs automatically on login and removes known malware that has already been installed.

**Why it matters:** MRT is the remediation layer — while XProtect blocks new infections, MRT removes existing ones. Its absence means infections may persist silently.

### 23. Rapid Security Response enabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 1.1 · Apple Apple RSR · PCI DSS PCI DSS 6.3.3

**What it does:** Checks that Rapid Security Response (RSR) is enabled — Apple's mechanism to push critical security patches between full macOS updates, without requiring a restart.

**Why it matters:** RSR patches actively exploited zero-days within hours of Apple's discovery. Without it, your Mac is exposed to known critical vulnerabilities between system updates.

### 24. Login Items reviewed
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.5.2 · NIST NIST CM-7

**What it does:** Lists all applications and agents configured to launch automatically at login, including both user-visible Login Items and background Launch Agents.

**Why it matters:** Malware and adware commonly persist by adding Login Items or Launch Agents. Unknown items launching at startup are a primary indicator of compromise.

### 25. Screensaver timeout ≤ 10 min
**Level:** Higiénico · **Weight:** weight 5 · **Profiles:** basic, hardened, paranoid
**Frameworks:** CIS CIS 2.4.1 · NIST NIST AC-11

**What it does:** Verifies that the screensaver activates within 10 minutes of inactivity, ensuring the screen lock engages automatically when the Mac is left unattended.

**Why it matters:** A Mac left unlocked for extended periods is physically accessible to anyone nearby. A short timeout is the simplest defense against opportunistic physical access.

### 26. Bluetooth Sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.5

**What it does:** Disables Bluetooth file sharing (OBEX), preventing other devices from browsing or transferring files to your Mac over Bluetooth.

**Why it matters:** Bluetooth sharing allows nearby devices to access files without authentication. Combined with predictable device names, it is a viable attack vector in public spaces.

### 27. Auto-join open WiFi disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.4.9 · NIST NIST SC-8

**What it does:** Checks that macOS is not configured to automatically join open (unauthenticated) WiFi networks without user confirmation.

**Why it matters:** Auto-joining open networks exposes your Mac to rogue access points and man-in-the-middle attacks. Attackers create hotspots with common names to intercept traffic silently.

### 28. Bonjour advertising limited
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.4.12 · NIST NIST CM-7

**What it does:** Disables mDNS/Bonjour service advertising so the Mac does not broadcast its presence and available services (printers, file shares, AirDrop) to other devices on the network.

**Why it matters:** Bonjour advertisements expose the device name, OS version, and running services to anyone on the same network segment — useful intelligence for attackers doing reconnaissance.

### 29. Diagnostics sharing disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.6.6 · NIST NIST PT-1

**What it does:** Disables automatic submission of crash reports, diagnostic data, and usage statistics to Apple and third-party developers.

**Why it matters:** Crash reports can contain sensitive data including memory dumps, file paths, usernames, and application state. Automatic submission happens without per-report review.

### 30. Location Services audited
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** NIST NIST PT-3 · Apple Apple Privacy

**What it does:** Lists applications that have been granted access to Location Services, allowing review of which apps can determine the Mac's physical location.

**Why it matters:** Location data is sensitive and persistent. Apps with background location access can track movements without obvious UI indicators.

### 31. Remote Management disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.8 · NIST NIST AC-17

**What it does:** Checks that Apple Remote Desktop (ARD) management is not active. ARD allows full remote control including screen viewing, file transfer, and command execution.

**Why it matters:** Active ARD with weak or default credentials is a complete system takeover vector. It is frequently targeted in enterprise environments and by malware.

### 32. Media Sharing disabled
**Level:** Profesional · **Weight:** weight 2 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 2.3.9

**What it does:** Disables Home Sharing and Media Sharing, which advertise the Mac's Music and Photos libraries to other Apple devices on the local network.

**Why it matters:** Media sharing exposes library metadata and content to any device on the network. Combined with network reconnaissance, it reveals user behavior and content.

### 33. iCloud Desktop & Documents audited
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** NIST NIST SC-28 · Apple Apple Privacy

**What it does:** Checks whether iCloud Drive is configured to sync Desktop and Documents folders automatically to Apple's servers.

**Why it matters:** When enabled, every file on your Desktop and in Documents — including sensitive documents, credentials files, and work files — is continuously uploaded to iCloud.

### 34. Lockdown Mode available
**Level:** Paranoid · **Weight:** informational · **Profiles:** paranoid
**Frameworks:** Apple Apple Lockdown Mode

**What it does:** Checks whether Lockdown Mode is enabled — Apple's extreme security mode that disables most attack surfaces including message link previews, web JIT, wired connections, and configuration profiles.

**Why it matters:** Lockdown Mode is designed for journalists, activists, and individuals targeted by sophisticated nation-state attacks. It dramatically reduces the attack surface at the cost of significant usability.

### 35. Captive portal detection reviewed
**Level:** Paranoid · **Weight:** weight 2 · **Profiles:** paranoid
**Frameworks:** NIST NIST SC-7

**What it does:** Disables the automatic captive network assistant that probes Apple servers when joining a new network to detect if a login page is required.

**Why it matters:** The captive portal probe sends DNS and HTTP requests to apple.com immediately on network join — before VPN activates. On hostile networks, this reveals your device identity.

### 36. Security audit logging active
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 3.2 · NIST NIST AU-2 · PCI DSS PCI DSS 10.2.1

**What it does:** Verifies that the BSM audit subsystem is active and logging security-relevant events including authentication attempts, privilege escalation, and file access.

**Why it matters:** Without audit logging, there is no forensic trail of authentication failures, sudo usage, or file access. Incident response becomes guesswork.

## ❔ Unverified (3)

### 1. Safari Suggestions disabled
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** NIST NIST PT-1 · Apple Apple Privacy

**What it does:** Disables Safari Suggestions, which sends the text typed in the address bar to Apple servers in real time to generate search and website suggestions.

**Why it matters:** Every URL fragment and search term typed in Safari is transmitted to Apple before you press Enter. This includes sensitive internal URLs, credentials typed accidentally, and research queries.

### 2. TCP timestamps disabled
**Level:** Paranoid · **Weight:** weight 2 · **Profiles:** paranoid
**Frameworks:** NIST NIST SC-7 · CIS CIS 3.6

**What it does:** Disables TCP timestamp options, which can reveal the system's uptime and help identify the OS version to remote scanners.

**Why it matters:** TCP timestamps allow passive OS fingerprinting — an attacker can determine your exact OS version and uptime without sending a single packet directly to your Mac.

### 3. Sudo timeout configured
**Level:** Profesional · **Weight:** weight 5 · **Profiles:** hardened, paranoid
**Frameworks:** CIS CIS 5.4 · NIST NIST AC-6

**What it does:** Configures sudo to require password re-entry for every command (timeout=0), preventing privilege escalation from an unattended terminal session.

**Why it matters:** By default, sudo caches credentials for 5 minutes. A malicious script running in an unattended terminal can silently execute privileged commands during this window.

## PCI DSS Compare

Evidence-based mapping only. This section shows which PCI DSS requirements are supported by local macOS checks, which mapped requirements still have gaps, and which controls still need manual evidence or are out of product scope.

| Metric | Value |
|---|---|
| Mapped score | 100/100 |
| Covered requirements | 8 |
| Gap requirements | 0 |
| Manual or out of scope | 5 |

### Covered by device checks

- **PCI DSS 1.4.1** — Personal firewall or network security controls active (`COVERED`)
  Evidence: Firewall
- **PCI DSS 2.2.2** — Only necessary services and insecure remote access disabled (`COVERED`)
  Evidence: Remote Login (SSH)
- **PCI DSS 3.5.1** — PAN and sensitive data protected with strong cryptography at rest (`COVERED`)
  Evidence: FileVault
- **PCI DSS 5.2.1** — Anti-malware mechanisms deployed and active (`COVERED`)
  Evidence: MRT active · XProtect up to date
- **PCI DSS 6.3.3** — Security patches and system components kept current (`COVERED`)
  Evidence: Automatic updates · Rapid Security Response enabled
- **PCI DSS 8.2.2** — Guest, shared, or unauthenticated access restricted (`COVERED`)
  Evidence: Guest User Disabled
- **PCI DSS 8.2.8** — Session lock and re-authentication enforced (`COVERED`)
  Evidence: Screen password
- **PCI DSS 10.2.1** — Audit logs enabled for security-relevant events (`COVERED`)
  Evidence: Security audit logging active

### Manual evidence required

- **PCI DSS 3.6.1** — Cryptographic key management and custodianship (`MANUAL`)
  Note: Requires process evidence, escrow handling, and operational controls outside a local macOS hardening check.
- **PCI DSS 8.3.1** — Multi-factor authentication for access into the CDE (`MANUAL`)
  Note: MFA posture depends on identity providers, VPN, MDM, and enterprise access flows not validated by MacLockdown alone.
- **PCI DSS 10.4.1** — Daily review of security logs and exceptions (`MANUAL`)
  Note: MacLockdown can confirm local logging, but not centralized review workflows, alerting, or documented analyst procedures.

### Not covered by this product

- **PCI DSS 11.3.1** — Internal vulnerability scanning (`OUT OF SCOPE`)
  Note: MacLockdown is not a vulnerability scanner and does not perform authenticated internal scanning.
- **PCI DSS 12.10.5** — Incident response training and readiness (`OUT OF SCOPE`)
  Note: Organizational incident response planning, training, and testing are outside the scope of device-local controls.
