Hello BigFix Community,
We are pleased to announce the release of a new compliance checklist within BigFix Compliance, designed to support the NIST Special Publication 800-53 Revision 5 framework for macOS.
As organizations work to align their endpoint environments with NIST SP 800-53 Rev 5, we are expanding our compliance library to help you automate and audit technical security controls effectively across your macOS environment.
What is the NIST 800-53 Rev 5 Compliance Checklist?
The NIST 800-53 Rev 5 Compliance Checklist is a new Checklist designed to assess and enforce compliance against the security and privacy controls defined in NIST 800-53 Revision 5 for macOS.
This checklist maps technical controls directly to NIST 800-53 Rev 5 control families, allowing you to monitor, enforce, and report on your macOS security posture against one of the most comprehensive federal security frameworks available.
Technical Snapshot
Here is a quick overview of the coverage provided in this release:
● Total Fixlets: 202
● Fixlets with Remediation: 68
● Parameterized Fixlets: 21
● Framework: NIST SP 800-53 Rev 5
● Applies To: macOS 14, macOS 15, macOS 26
Scope of Coverage
This checklist focuses on the technical controls that can be monitored and enforced via BigFix, mapped to NIST 800-53 Rev 5 control families. We currently support controls across 8 control families:
● Access Control (AC) (57 checks)
o AC-2 Account Management (6)
o AC-3 Access Enforcement (4)
o AC-6 Least Privilege (5)
o AC-7 Unsuccessful Logon Attempts (3)
o AC-8 System Use Notification (4)
o AC-11 Device Lock (7)
o AC-12 Session Termination (8)
o AC-17 Remote Access (6)
o AC-20 Use of External Systems (14)
● Audit and Accountability (AU) (29 checks)
o AU-5 Response to Audit Logging Process Failures (3)
o AU-8 Time Stamps (3)
o AU-9 Protection of Audit Information (17)
o AU-11 Audit Record Retention (2)
o AU-12 Audit Record Generation (4)
● Configuration Management (CM) (65 checks)
o CM-6 Configuration Settings (35)
o CM-7 Least Functionality (29)
o CM-11 User-Installed Software (1)
● System and Communications Protection (SC) (7 checks)
o SC-7 Boundary Protection (2)
o SC-13 Cryptographic Protection (2)
o SC-28 Protection of Information at Rest (3)
● Identification and Authentication (IA) (24 checks)
o IA-2 Identification and Authentication (Organizational Users) (10)
o IA-5 Authenticator Management (12)
o IA-6 Authentication Feedback (2)
● System and Information Integrity (SI) (18 checks)
o SI-2 Flaw Remediation (7)
o SI-3 Malicious Code Protection (4)
o SI-7 Software, Firmware, and Information Integrity (7)
● Media Protection (MP) (1 check)
o MP-7 Media Use (1)
● Contingency Planning (CP) (1 check)
o CP-9 System Backup (1)
How to Get Started
- The NIST 800-53 Rev 5 Checklist for macOS is available now. To get started, subscribe to the content from the NIST 800-53 Rev 5 Checklist for macOS external site and deploy it to your desired endpoints.
- Enable and gather the NIST 800-53 Rev 5 Checklist for macOS external site from the License Overview Dashboard.
- Create a custom site using the Create Custom Checks wizard.
- Change the default parameters if required.
- If you use custom sites, update them to use the latest content. You can synchronize your content by using the Synchronize Custom Checks wizard. For more information, see Using the Synchronize Custom Checks wizard.
- Subscribe all the relevant macOS 14, macOS 15, and macOS 26 endpoints.
- Run Environment Setup Task and wait for its completion
- Run SCA import to get compliance status reports.
To know more about the BigFix Compliance SCM checklists, accordingly, please see the following resources:
● BigFix Forum: https://forum.bigfix.com/c/release-announcements/compliance
● BigFix Compliance SCM Checklists: https://forum.bigfix.com/c/releaseannouncements/scm-checklists/86
We are committed to helping you stay compliant with the latest regulatory frameworks. If you have questions regarding specific checks or need assistance with implementation, please feel free to reply to this thread.
– The BigFix Compliance Team