Why don’t any of the host configuration checking tools work on the mac?   CIS, Bastille, ossec (they don’t do conf checking on mac, plus they claim to check CIS...