System Integrity Protection (SIP) Status Message got Changed on Mac OS X 10.11.2 El Capitan

In order to check whether System Integrity Protection (SIP) is enabled or disabled on a Mac running OS X El Capitan, you can use the csrutil command to report on SIP’s current status.

To check if SIP is enabled or disabled, run the following command in Terminal:

csrutil status

1	csrutil status

This command can be run without root privileges and will tell you if SIP is on or off.

If SIP is enabled on 10.11.0 or higher, you should receive the following message:

System Integrity Protection: enabled

1	System Integrity Protection: enabled

If SIP is disabled on OS X 10.11.0 or 10.11.1, you may receive a confusing message which indicates that SIP is enabled, followed by a list of individual SIP functions which are disabled. If all functions listed are showing as being disabled, SIP is completely disabled.

System Integrity Protection status: enabled (Custom Configuration).

Configuration:
		Apple Internal: disabled
		Kext Signing: disabled
		Filesystem Protections: disabled
		Debugging Restrictions: disabled
		DTrace Restrictions: disabled
		NVRAM Protections: disabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

System Integrity Protection status: enabled (Custom Configuration).

Configuration:

Apple Internal: disabled

Kext Signing: disabled

Filesystem Protections: disabled

Debugging Restrictions: disabled

DTrace Restrictions: disabled

NVRAM Protections: disabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

It appears that Apple has updated the status message on OS X 10.11.2 to make it much more clear when SIP is disabled. On 10.11.2, if SIP is disabled, you now should receive the following message: