If Jamf manages a setting, check its current state. Do not change the management configuration.
Progress
0 of 9 complete
Checks
01
FileVault disk encryption
Check that FileVault is on.
Review instructions
FileVault protects the contents of a lost or stolen Mac.
System Settings
Open Apple menu › System Settings › Privacy & Security › FileVault.
Confirm the panel says “FileVault is turned on for the disk”.
Optional · Terminal
fdesetup status
Expected: FileVault is On.
If it needs fixing
Select Turn On FileVault and follow the managed Mac prompts. If the control is locked or managed, verify the displayed state only. Restart if macOS asks you to.
Enable automatic security updates and use a supported macOS release.
Review instructions
Updates close known vulnerabilities. Apple warns that previous major releases may not receive fixes for every known security issue.
System Settings
Open Apple menu › System Settings › General › Software Update.
Install the latest approved update offered for your Mac.
Open Automatic Updates and confirm update checks, downloads, macOS updates and security responses/system files are enabled.
Use Apple menu › About This Mac to note the macOS major version, then compare it with Apple’s current release list. The current major release is the baseline target; a previous major needs an approved compatibility reason.
Optional · Terminal
sw_vers
ProductVersion shows the installed macOS version.
If it needs fixing
Enable automatic updates and install the latest approved macOS update. If your Mac cannot run a supported release, ask about a replacement.
Pass when
Automatic security updates are enabled and the Mac is on the current major release, fully patched to the latest offered version—or a previous major has a documented, time-limited compatibility approval.
Turn Firewall on. If an application stops accepting required inbound connections, add the minimum specific app exception instead of disabling the firewall.
Pass when
Firewall is on and exceptions are limited to required, recognised software.
Allow apps from the App Store and identified developers.
Review instructions
Gatekeeper checks downloaded software is signed, notarised and unaltered before it runs.
System Settings
Open Apple menu › System Settings › Privacy & Security.
Under Security, confirm downloaded apps are allowed from “App Store and identified developers”.
Do not use Open Anyway for an untrusted app. A required bypass must have a documented business reason and trusted source.
Optional · Terminal
spctl --status
Expected: assessments enabled.
If it needs fixing
Select “App Store and identified developers”. For a required app that is blocked, verify its publisher and download source, then document the reason before using macOS’s one-app override.
Pass when
Gatekeeper assessments are enabled and the allowed-source setting is App Store and identified developers.
Automatic login lets someone access a Mac after restart; Guest User creates an additional local access path.
System Settings
Open Apple menu › System Settings › Users & Groups.
Confirm “Automatically log in as” is Off. FileVault may make this setting unavailable, which is acceptable.
Open Guest User and confirm “Allow guests to log in to this computer” is off. Also keep guest access to shared folders off.
If it needs fixing
Set automatic login to Off. Open Guest User and disable guest login and shared-folder access. Do not remove named accounts you do not recognise—raise them for review.
Pass when
Automatic login is off and Guest User cannot log in or connect to shared folders.
Every enabled sharing service adds a network-access path and should have a specific, current purpose.
System Settings
Open Apple menu › System Settings › General › Sharing.
Confirm Remote Login, File Sharing, Screen Sharing, Remote Management, Remote Application Scripting, Internet Sharing, Media Sharing, Printer Sharing, Bluetooth Sharing and Content Caching are off unless approved.
If Jamf manages a setting, verify the resulting state; do not try to remove the management profile.
If it needs fixing
Turn off services you do not actively need. For a required service, restrict it to the smallest user set and network scope available, then document the exception.
Pass when
All sharing services are off, or every enabled service has a current documented need and restricted access.
Connect your Mac and check that Aikido blocks its test package.
Review instructions
Aikido checks developer packages and extensions for known threats and can block releases that are too new.
Aikido app & dashboard
Create an individual Aikido developer account on the Free plan. Individual accounts avoid sharing your installed-software inventory with team administrators.
Sign in to the dashboard, open Devices and choose Connect Device. Download the macOS app and follow the installation prompts.
Open the app and check that your device is connected and protection is running.
In Ecosystems, choose Test beside an enabled ecosystem. Follow the example shown in the app.
Run the test in an empty throwaway folder and check that Aikido blocks the installation.
Check which ecosystems are enabled in your app. If you need protection that your plan does not include, ask Sami.
Aikido test · Terminal
npm install aikido-endpoint-test
For npm, run this in an empty throwaway folder when prompted by the app. Aikido should block it.
If it needs fixing
If your device is not connected or the test is not blocked, check that Aikido is running and repeat Connect Device. If an ecosystem is unavailable on the Free plan, ask Sami.
Pass when
Your device is connected, protection is running and a test installation is blocked.