Description
Jamf Pro 11.16 introduced Jamf Pro compliance benchmarks which is a service that makes it easier for Jamf Pro administrators to audit and enforce compliance standards on managed computers.
While originally just supporting CIS Levels 1 and 2, in October and December 2025 additional templates were added. The full list of templates is provided in the Compliance Benchmarks Configuration Guide.
A few things to note:
Compliance benchmarks may have releases separate from Jamf Pro.
It has it's own Learning Hub documentation separate from Jamf Pro.
Signed in users must be logged in to Jamf Pro using a Jamf ID or identity provider credentials from an SSO connection in Jamf Account
Jamf Pro leverages the macOS Security Compliance Project (mSCP) for templates, underlying security guidance, and configurations.
For more information, see the mSCP GitHub repository.
Frequently Asked Questions
What are the pre-requisites? Do I have to use OIDC SSO?
What are the pre-requisites? Do I have to use OIDC SSO?
The full list of requirements is listed in the Compliance Benchmarks Configuration Guide. There are few clarifications below.
The Compliance menu item will not show in the left sidebar for organizations whose environments are not compatible.
Yes, OIDC-based SSO through Jamf Account must be enabled in Jamf Pro and the user must sign into Jamf Pro with either:
Jamf ID
Identity Provider credentials for an SSO Connection added to Jamf Account for your Organization
if logging in with a local Jamf Pro user or via SAML SSO, compliance benchmarks will not be available to use.
What about existing benchmarking profiles and other configuration in Jamf Pro? Will they be automatically migrated into a compliance benchmarks configuration?
What about existing benchmarking profiles and other configuration in Jamf Pro? Will they be automatically migrated into a compliance benchmarks configuration?
No, you will need to migrate existing compliance related profiles, scripts and other configuration manually.
Are the objects created by compliance benchmarks visible or hidden? Can they be manually edited?
Are the objects created by compliance benchmarks visible or hidden? Can they be manually edited?
After the benchmark is deployed, the objects will show in Jamf Pro in their usual location (Settings > Categories, Computers > Policies, etc.).
The edit button still works for these objects; however, they are not intended to be edited or deleted. Doing so can cause issues with deploying future changes and the entire benchmark would need to removed and redeployed.
The objects cannot be edited from Compliance > open benchmark > open Management Settings.
How can I provide feedback on how a rule is audited, deployed, managed or remediated?
How can I provide feedback on how a rule is audited, deployed, managed or remediated?
This project is based off the macOS Security Compliance Project hosted by US Government agency, NIST. Jamf does not control how a rule is created, written, scripted. Please provide that feedback in the NIST GitHub (link to project home, link for submitting issues).
What happens when a benchmark is deleted?
What happens when a benchmark is deleted?
The benchmark configuration is removed and compliance monitoring stops for previously scoped devices.
Configuration profiles will uninstall from devices.
Settings deployed via Script are not undone/reset when a benchmark is deleted. This behavior is consistent with mSCP, Jamf Compliance Editor, and other MDM solutions' implementations.
All associated management settings are automatically deleted from Jamf Pro.
What reporting options exist?
What reporting options exist?
The reporting options have expanded since the initial launch of compliance benchmakrs. You can export the Rule reports as well as download audit documentation.
You can also build your own compliant or noncompliant report using Advanced Searches in Jamf Pro. For example the group below just uses the computer group criteria and pulls from the Compliant group the benchmark created.
To create a report from an Advanced Search:
Ensure desired inventory columns are added for the report, for more information see Computer Inventory Display Settings in the Jamf Pro Documentation.
Create a new Advanced Search (save it for reporting ease), following the steps on Creating Reports for Advanced Computer Searches in the Jamf Pro Documentation.