Q: how to secure boot sequence on the latest Mac (Mini)

This

If you lost or forgot your firmware password - Apple Support

says that on newer Mac (as specified in the article) includes

If you can't remember the firmware password for your Mac, schedule a service appointment with an Apple Retail Store or Apple Authorized Service Provider. Bring your proof of purchase (original receipt or invoice) with you. If you plan to visit an Apple Retail Store, make a reservation (available only in some countries).

Are you wanting to prevent a boot entirely, or to just limit which disk is used (boot sequence of sorts) to start up from?

Macs don;t have a BIOS dialog that you access like on a non-Mac PC.

Your regular Admin password should protect your mini from having its startup disk changed. If only your account appears on the startup screen, then a non account holder can't get past that screen.

While requiring a login password and also setting admin functions in System Preferences -> Security & Privacy -> Advanced… would prevent someone changing the boot drive setting it does not prevent someone holding down the Option key when turning on the Mac and then selecting an alternate boot drive.

Open Firmware Password protection does lock the boot drive choice so even the Option key cannot be used to alter it.

See Use a firmware password on your Mac - Apple Support

It locks it to a single choice, it does not allow any alternate choices, it is therefore not like the BIOS setup on PCs where you can set the order of multiple devices and then lock that order.

Dukee130 wrote:

 

Thank you for your response.

This answers my 1st question.

How difficult is it to reset a Firmware password on a Mac?

On a PC, for example, all one has to do to reset a BIOS password is to perform a BIOS reset which is a matter of opening a computer and pressing a button.

I have been looking at a Mac alternative as I have an assumption that resetting a firmware password would be more difficult than that.

 

ta

Illaass had already replied with an answer on what to do if you forget the Firmware Password.

As a reminder see If you lost or forgot your firmware password - Apple Support

Not for the newer Macs. For the older ones removing a RAM stick did work but things like that for the newer ones do not work. Apple learned that the previous method of firmware password was not at all secure.

As an addendum to Illaass' reply about Firmware password backdoors, half the current models of Mac have soldered to the logic board memory so not only has this backdoor been closes previously but it is no longer physically possible to remove the memory in any case.