throwaway8334

I've set this up once. It is a mammoth and ongoing effort to tune it for your org. Ended up dropping it for all but the most locked down machines.

You can get most of the way to hardening to CIS level 1 picking more up-to-date fork of these https://github.com/jamf/CIS-for-macOS-Catalina-CP.

FWIW, CIS level 1 will mean people get locked out of their machines very frequently. Complex 15 character passwords with 3 retries from memory. So you need a half-decent MDM to unlock quickly. There is no half-decent MDM out there. Only shit ones but workable like Jamf.

Also the username does't get auto-populated on login so the typo can be in username but the user assumes it is with password. Very fast way to get lock outs.

To pass a full security review you might want to play with Google Santa. But that is intense.

Also disabling things like AirDrop and biometric unlock is a productivity inhibitor.

Disabling Bonjour can cause strange problems for some people (e.g. using Reflector 4).

Basically I hate my mac that is hardened all the way so have a second machine (Mac Studio Ultra) in a more secure location that is less hardened and more pleasant to work with.