How to turn on System Integrity Protection (SIP) for your Mac

MacBook Pro
MacBook Pro (Image credit: Rene Ritchie/iMore)

Introduced as part of OS X El Capitan, System Integrity Protection (SIP) was designed to provide a type of root-level shielding to the Mac similar to what the iPhone and iPad have benefited from for years. It should be enabled on any new Mac running El Cap, and certainly running the current macOS Sierra. Some new MacBook Pro 2016 owners, however, have booted up their new machines to find SIP disabled instead. My guess is Apple is already hard at work on a fix, but in the meantime, here's how to turn it back on yourself!

How to check if System Integrity Protection is enabled on your Mac

Before turning SIP on, the first thing you need to do is make sure it isn't on already.

  1. Launch Terminal on your Mac.
  2. Type in "csrutil status" (or copy and paste it in from here).

If SIP is ON, you'll get this message in response: "System Integrity Protection status: enabled." If you see that, you're fine and you can stop reading and go back about your business.

If SIP is OFF, you'll get this message: "System Integrity Protection status: disabled". If you see that, you should absolutely turn it back on, so keep reading!

How to turn System Integrity Protection on

If SIP is off, you'll want to turn it back on. It provides significant security advantages for your Mac.

Note: You'll need to reboot your Mac to make the change, so you should either load these directions up on your iPhone or iPad so you can keep following along, or print them out for easy reference.

  1. Click on the  (Apple Logo) at the far left of your Mac's Menubar.
  2. Click on Restart.
  3. Hold down CMD + R during reboot to enter Recovery Mode.
  4. Click on the Utilities Menu.
  5. Launch Terminal.
  6. Type in "csrutil enable".
  7. Restart your Mac again.

Let your Mac reboot normally this time. When it does, System Integrity Protection should be re-enabled. You can double check to make sure:

  1. Launch Terminal on your Mac.
  2. Type in "csrutil status" (or copy and paste it in from here).

If SIP is ON, you'll get this message in response: "System Integrity Protection status: enabled." If you see that, you're fine and you can stop reading and go back about your business.

Any questions?

If you have any questions, drop them in the comments below!

Rene Ritchie

Rene Ritchie is one of the most respected Apple analysts in the business, reaching a combined audience of over 40 million readers a month. His YouTube channel, Vector, has over 90 thousand subscribers and 14 million views and his podcasts, including Debug, have been downloaded over 20 million times. He also regularly co-hosts MacBreak Weekly for the TWiT network and co-hosted CES Live! and Talk Mobile. Based in Montreal, Rene is a former director of product marketing, web developer, and graphic designer. He's authored several books and appeared on numerous television and radio segments to discuss Apple and the technology industry. When not working, he likes to cook, grapple, and spend time with his friends and family.

  • Never knew about SIP! Does it work like Windows Firewall? Thanks.
  • SIP and firewalls are two very different things. Firewalls block certain network traffic coming in that might be malicious, SIP protects the core operating system files by literally allowing nothing to edit them except Apple's software updates. macOS has a firewall which you can find in System Preferences
  • It's more like Windows System Protection (remember back in the day when Windows kept asking if you wanted to do something system based?)
    This stops me from making main system changes (like changing the SSHD port to something obscure), System tweakers beware.
  • Thanks guys. I know about Windows Firewall(I'm belong to Compute Infrastructure domain) :)
  • You can also type "csrutil disable" as well. If you decide you want to monitor yourself, or change lower level things. As someone who worked for Apple, this is a reaction to customers installing malware because of Apple's "features". I couldn't tell you how many customers fell for those "OMG YOU HAVE TEH VIRUZ!!! CALL TIS #!!!" malware site popups because of "SavedStates" and "Fullscreen without asking". People reading this may not think those things are problematic, but anyone else who does/did AppleCare Mac+ support should be able to corroborate that this is a high number of these calls. Apple caused their own "virus" issue by not realizing less sophisticated people don't know what is happening when they see those popups, or why it comes back after a reboot. If you don't think SavedStates are an issue as people don't know what they are, see Leo Laporte get stumped by it: iOS the fix is Settings -> Safari -> Reset Safari OSX (Safari) -> Force Quit Safari -> Menubar -> Go -> Hold Alt + Click Library -> Go to Saved Application States -> Delete com.Apple.Safari.whatever (Similar for Chrome)
  • So this SIP is not included in OS X Mavericks? What if I do not want to upgrade to latest OS X? Sent from the iMore App
  • Then you get left behind? What else are you expecting? Of course older OS's are not going to have the latest features…
  • Blame it on Apple! I no longer trust Apple's upgrade after the iPad iOS 8 and 9 upgrade disaster. My iPad is as good as dead, sluggish, slow and almost useless. Apple software under Tim is cooked!
  • I can't say I've had this experience myself, I updated a 2012 MacBook Pro to Sierra, no slow-down issues. My friend has an iPhone 5 running iOS 10 and again, no slow-down issues. Maybe try restoring your iPad? I doubt you'll have any issues if you update your version of macOS
  • Could it be possible when I turned SIP off to delete root files from an old backup that it would restart the computer occasionally on its own after re-enabling SIP? Sent from the iMore App