five baseline checks every mac should pass

why your mac needs a two minute checkup

new mac out of the box feels secure. it looks clean, it's fast, apple's marketing says "privacy built in." but out of the box settings and secure settings aren't always the same thing. there are four built in protections on every mac that matter a lot, and one of them is off by default. nobody tells you that part. this post walks through all five checks so you know exactly what your machine is actually doing to protect you, not what you assume it's doing.

check one: is your disk actually encrypted

filevault is apple's full disk encryption. if it's off, anyone who gets physical access to your mac, whether that's a thief, a repair shop, or someone borrowing your laptop for "just a second," can pull the drive and read your files without ever touching your password.

fdesetup status

you want this to say filevault is on. if it says off, open system settings, go to privacy and security, and turn it on there. it'll encrypt in the background while you keep working.

check two: is gatekeeper screening your apps

gatekeeper is the thing that checks whether an app you're about to open is signed and notarized by apple before it's allowed to run. it's the first line of defense against malware disguised as a random app you downloaded off some site that definitely isn't the actual developer's website.

spctl --status

you're looking for assessments enabled. if it comes back disabled, something turned it off, maybe you did it yourself months ago to install something sketchy and forgot to turn it back on. re-enable it through system settings or with sudo spctl --master-enable.

check three: your firewall is probably off right now

this is the one that surprises people. macos ships with a firewall, but it is not turned on by default. that means your mac is sitting there accepting incoming connections on open ports with nothing filtering them.

socketfilterfw --getglobalstate

if it says the firewall is disabled, turn it on:

sudo socketfilterfw --setglobalstate on

this blocks unsolicited incoming connections while letting your normal outgoing traffic, browsing, apps, updates, work exactly as it did before. it's not going to slow you down or break anything you use daily. it just closes a door that was sitting wide open.

check four: is system integrity protection locked down

sip is apple's protection that stops even an admin account, or malware running as an admin account, from modifying protected system files and folders. it's the wall between "i have a password" and "i can rewrite core parts of the operating system."

csrutil status

you want system integrity protection status: enabled. some tutorials online tell you to disable sip to install some tool or tweak. if you did that at some point and forgot, this is where you catch it. re-enabling it requires booting into recovery mode, which is apple's way of making sure you really mean to flip this one.

why these five together matter

none of these checks are flashy. there's no dashboard, no app, no subscription. that's the point. apple built real protection into every mac and just didn't turn all of it on or make it obvious to check. filevault protects your data at rest, gatekeeper screens what you run, the firewall filters what reaches you from the network, and sip protects the operating system itself from tampering. each one covers a different attack surface. skip one and you've got a gap, even if the other three look great.

the takeaway

run all five commands right now, it takes less time than making coffee. fix anything that's off, especially the firewall, since that's the one almost everyone has sitting disabled without knowing it. then do this again after any major macos update, since updates occasionally reset settings you don't expect. security isn't a one time setup, it's a habit you check on. two minutes, every few months, and you're ahead of most mac users out there.