The SystemIntegrityProtection control verifies that macOS System Integrity Protection (SIP) is enabled. SIP is a security feature that protects critical system files and processes from being modified, even by users with administrator privileges or by malware with root access.
Important: SIP works at a fundamental level in macOS, preventing unauthorized modifications to essential system files, frameworks, and applications. Even if malware gains administrative access to your Mac, SIP prevents it from tampering with core macOS components. SIP is usually only disabled intentionally by developers or system administrators for very specific technical reasons, but doing so significantly weakens your Mac's security by removing this fundamental protection layer.
SIP prevents malware and unauthorized software from modifying critical macOS components, ensuring your system remains in a known, secure state.
Even advanced malware with root access cannot bypass SIP to install rootkits or modify protected system files, providing defense against sophisticated attacks.
SIP prevents unauthorized kernel extensions and system modifications that could compromise your Mac's security, stability, and privacy at the deepest level.
SIP is usually only disabled for specific technical reasons:
If you disabled SIP for a specific task, it should be re-enabled afterward. Contact IT support to determine if you still need SIP disabled or if it can be safely re-enabled.
After enabling System Integrity Protection, Citadel will automatically verify this control during its next check.