Short answer
Yes. A supported macOS version can meet Cyber Essentials when the device is correctly configured, updated and protected by an accepted malware-control option. Verify the actual protection settings and other applicable controls against the v3.3 requirements; the presence of XProtect or Gatekeeper alone is not proof. FileVault encryption is useful hardening, not a universal requirement of the five-control scheme.
Why this matters
Technical-control questions decide whether the self-assessment can be approved. Cyber Essentials is not a paper-only exercise: the applicant must be able to show that secure configuration, patching, access control, malware protection, and firewalls are implemented in the actual environment.
The strongest submissions use evidence from device management, endpoint security, vulnerability scanning, identity controls, and asset registers. If a control is implemented manually, the organisation should still be able to explain ownership, frequency, and how exceptions are handled.
What to check next
- Apply every qualifying high-risk, CVSS v3 7+ or unspecified-severity fix within 14 days of release.
- Remove unsupported software or agree the permitted isolated subset with the assessor.
- Keep endpoint protection, firewall rules, and admin accounts documented.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.