Use Startup Security Utility to make sure that your Mac always starts up from your designated startup disk, and always from a legitimate, trusted operating system.
If you're using a Mac with the Apple T2 Security Chip, Startup Security Utility offers three features to help secure your Mac against unauthorized access: Firmware password protection, Secure Boot, and the ability to set allowed boot media.
If you're using a Mac with Apple silicon, learn how to change security settings on a Mac with Apple silicon.
You can use a firmware password to prevent anyone who doesn't have the password from starting up from a disk other than your designated startup disk. To set a firmware password in Startup Security Utility, click Turn On Firmware Password, then follow the onscreen instructions. Learn more about firmware passwords.
You can also disallow booting from external or removable media to prevent even those who know the firmware password from starting up from such media.
Use these settings to make sure that your Mac always starts up from a legitimate, trusted operating system.
Full Security is the default setting, offering the highest level of security. This is a level of security previously available only on iOS devices.
During startup, your Mac verifies the integrity of the operating system (OS) on your startup disk to make sure that it's legitimate. If the OS is unknown or can't be verified as legitimate, your Mac connects to Apple to download the updated integrity information it needs to verify the OS. This information is unique to your Mac, and it ensures that your Mac starts up from an OS that is trusted by Apple.
If FileVault is enabled while your Mac is attempting to download updated integrity information, you're asked to enter a password to unlock the disk. Enter your administrator password, then click Unlock to complete the download.
If the OS doesn't pass verification:
If your Mac can't connect to the internet, it displays an alert that an internet connection is required.
in the menu bar. Then click Try Again.During startup when Medium Security is turned on, your Mac verifies the OS on your startup disk only by making sure that it has been properly signed by Apple (macOS) or Microsoft (Windows). This doesn't require an internet connection or updated integrity information from Apple, so it doesn't prevent your Mac from using an OS that is no longer trusted by Apple.
If the OS doesn't pass verification:
No Security doesn't enforce any of the above security requirements for your startup disk.
