Ensure System Integrity Protection Status (SIP) Is Enabled

How it is checked

Audit method: Shell command

out=$(/usr/bin/csrutil status 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -q "System Integrity Protection status: enabled" && echo compliant

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal Method: Perform the following steps to enable System Integrity Protection: 1. Reboot into the Recovery Partition (system-reboot and hold down Command (⌘) + R) 2. Select Utilities 3. Select Terminal 4. Run the following command: # /usr/bin/sudo /usr/bin/csrutil enable Successfully enabled System Integrity Protection. Please restart the machine for the changes to take effect. 5. Reboot the computer Note: You should research why the system had SIP disabled. It might be a better option to erase the Mac and reinstall the operating system. That is at your discretion. Note: You cannot enable System Integrity Protection from the booted operating system. If the remediation is attempted in the booted OS and not the Recovery Partition the output will give the error csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target macos