We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which can't be disabled by the person using the computer.
The only mobile computers we have which that requirement applies to belong to our system administrators, and they're all Macs. (This is apparently trivial in Windows -- pretty much every endpoint protection solution implements it.) Since they're sysadmins, they've got admin access to their Mac.
I've had a couple of endpoint protection vendors promise me a solution only to fall through when we tried it out (in particular, Symantec), and now I'm stuck.
Does anyone know of something that will meet this requirement in OS X (personal firewall software which can't be modified by the end-user, even when the user has admin access)?