Apple has done a great deal to improve the security of Macs over the last decade. This is particularly true for the latest generations of Intel-based Macs equipped with T2 security chips. With macOS Catalina, Apple also separated system files from your personal data, helping protect the operating system from unwanted changes. Another important but lesser-known element that further boosts your Mac’s security is the Startup Security Utility. In this article, we'll break down what the Startup Security Utility is and show you how to use it.

What is the Startup Security Utility?

Startup Security Utility is a tool available through macOS Recovery. On Intel-based Macs with a T2 security chip, it lets you set a firmware password, which prevents your Mac from starting up from an external drive, CD, or DVD without that password, adding an extra layer of protection against unauthorized access.

For both Intel-based and Macs with Apple Silicon, the Startup Security Utility offers different levels of security. By default, it is set to "Full Security," and it is recommended to keep this setting unless you have a specific reason to reduce security. Here are the three security options available for Intel-based Macs:

  • Full Security: Allows only the current operating system or another OS currently trusted by Apple to run.
  • Medium Security: Allows your Mac to run any version of any OS ever trusted by Apple to run.
  • No Security: Doesn’t enforce any security protocols on the OS.

Intel-based Macs with T2 chips also have an option to prevent booting from any external media at all.

On Macs with Apple Silicon, the security options are:

  • Full Security: The same as for Intel-based Macs with T2
  • Reduced Security: The same as Medium Security for Intel-based Macs

You can also enable these options in the Reduced Security setting:

  • Allow user management of kernel extensions from identified developers
  • Allow remote management of kernel extensions and automatic software updates

If you own a Mac with Apple Silicon, you can’t set a firmware password. However, you can set one by turning on File Vault.

When would you use the Startup Security Utility?

Most Mac users typically do not need to use the Startup Security Utility. However, there are a few situations where it might be necessary:

  1. You want to prevent or enable booting from an external disk.
  2. You want to install a version of macOS that is not currently on Apple’s trusted list, or, on an Intel-based Mac, a version of Windows or Linux that isn’t on that list.
  3. You need to enable kernel extensions to install and use a specific application on your Mac.
Tip: Keep your Mac running smoothly

We’ve all experienced those moments when our Mac feels sluggish: apps take too long to open, or everything seems slower than usual. Most of the time, we just deal with it and move on. But when it starts getting in the way of your productivity, it's time to do something about it.

That’s why running regular maintenance on your Mac is a good idea. This includes clearing out junk files, removing duplicates, and cleaning up clutter like outdated cache and temporary files. That’s a lot to keep track of. That’s where CleanMyMac comes in. Its Smart Care feature handles all those tasks for you in just a few clicks. It’s reliable, easy to use, and helps keep your Mac running at its best when you’re busy with something more important. Start your free CleanMyMac trial.

How to use Startup Security Utility

Before you change any security settings on your Mac, remember to revert them to their original state as soon as possible to keep your Mac secure.

  1. Boot your Mac in Recovery mode. To do that on an Intel-based Mac, shut down your Mac and then press the power button while holding Command-R. Wait for the Apple logo to appear, then release the keys. Wait a little longer for macOS Utilities to appear. On a Mac with Apple Silicon, shut it down, then press and hold the power button until you see the startup options screen. Click Options, then Continue — type in your username and password.
  2. When you see the macOS Utilities screen, click the Utilities menu and choose Startup Security Utility.
  3. Choose the option you want.
  4. Restart your Mac normally.

What to do if Startup Security Utility is not showing

If you don’t see the Startup Security Utility, you’ll typically get a message saying that no administrator was found. To fix this, restart your Mac, then go to System Settings > General > Users & Groups and create a new administrator account. The next time you boot into Recovery mode, you’ll be able to log in with that account, and the Startup Security Utility should appear. You can find more help with the “no administrator was found” error in this article.

If the Utilities menu doesn’t appear and you don’t see an error message, it’s likely that your Mac didn’t boot into Recovery mode. Follow the steps above to enter Recovery mode again, depending on whether you’re using an Intel-based Mac or a Mac with Apple silicon.

Startup Security Utility is built into macOS Recovery and helps you manage key security settings for starting up your Mac. On Intel-based Macs with a T2 chip and on Macs with Apple Silicon, it lets you choose the level of security required to boot your system. Follow the steps above to access and use Startup Security Utility on your Mac.