Cyber Essentials on a Mac: five settings and one honest check

Where Macs appear in the assessment

Each Mac is an in-scope end-user device: listed in your asset register with the exact macOS version (A2.6), behind a firewall (A4.1.1), securely configured (A5.x), on a supported OS with updates inside 14 days (A6.x), and protected against malware (A8.x). For a typical small business most of it needs no extra software — it needs the following settings checked, about five minutes per machine.

1. Record the version — exactly (A2.6, A6.1)

Apple menu → About This Mac. Write the name and number into your asset register as shown — “macOS 15” style, not “latest”. Apple publishes which versions still receive security updates — the current list, alongside Windows, iOS and Android, is in the supported operating systems reference; a Mac older than those is unsupported, which is an automatic fail while it’s in scope (A6.1), and old MacBooks age out quietly. IASME’s own guidance to A6.1 names macOS Ventura as an example of an operating system out of regular support, so Ventura (macOS 13) and anything older fails. If a machine can’t update to a supported version, it’s the same decision as any unsupported device: upgrade, replace, or remove from scope.

2. Turn the firewall on (A4.1.1)

System Settings → Network → Firewall — switch it on. It is off by default on a new Mac, and the questionnaire asks about the software firewall on every computer, which matters most for laptops that work from home networks and café Wi-Fi where there’s no office router in front of them.

3. Automatic updates, all of them (A6.4, A6.4.1)

System Settings → General → Software Update → click the (i) next to “Automatic updates” and turn everything on — especially “Install Security Responses and system files”, which is how Apple ships urgent security fixes between full updates. High-risk updates must land within 14 days; automatic updates plus actually restarting when asked is how a Mac meets that without anyone thinking about it.

Apps from the App Store are a separate switch: open the App Store, then App Store → Settings → turn on “Automatic Updates”. Those app updates count under the application questions (A6.5, A6.5.1), not the macOS ones — and apps installed from outside the App Store update through their own settings.

4. Malware protection: one of two options (A8.1–A8.5)

Either rely on anti-malware that updates itself, stops malware running and warns about or blocks known malicious websites (A8.2, A8.3) — macOS has built-in protection, but check the IASME Knowledge Hub’s current position before relying on it alone. Or use application allow-listing: System Settings → Privacy & Security → “Allow applications from” set to “App Store” or “App Store & Known Developers” — never “Anywhere” — and a written list of approved apps that staff stick to (A8.4, A8.5). The malware guide has the full picture.

5. Lock and unlock (A5.9, A5.10)

System Settings → Touch ID & Password: a login password of at least 6 characters (Touch ID sits on top of it), and the screen locking automatically after a few minutes idle (Lock Screen settings). If that password also signs in to work data, it must meet the full password rules (A7.11). FileVault disk encryption is good practice and freely available, but it is not a Cyber Essentials requirement — don’t let a nice-to-have delay the required five.

The rest is account hygiene, not Mac settings

Remove software nobody uses and old user accounts (A5.1, A5.2), keep admin rights on a separate account rather than the everyday login (the user-access guide), and remember the Mac’s cloud logins — Microsoft 365, Google Workspace and the rest — carry the MFA requirements whatever the hardware. A mixed Mac-and-Windows office answers the same questions; only the menu names differ.