STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Apple visionOS 2 Security Technical Implementation Guide

Version

V1R1

Benchmark ID

Apple_visionOS_2_STIG

Total Checks

50

Tags

other
CAT I: 3CAT II: 35CAT III: 12

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (50)

V-276374LOWApple visionOS 2 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis].V-276375MEDIUMApple visionOS 2 must not allow backup to remote systems (iCloud).V-276376MEDIUMApple visionOS 2 must not allow backup to remote systems (iCloud document and data synchronization).V-276377MEDIUMApple visionOS 2 must not allow backup to remote systems (iCloud Keychain).V-276378MEDIUMApple visionOS 2 must not allow backup to remote systems (Cloud Photo Library).V-276379MEDIUMApple visionOS 2 must not allow backup to remote systems (managed applications data stored in iCloud).V-276380MEDIUMApple visionOS 2 must be configured to enforce a minimum password length of six characters.V-276381MEDIUMApple visionOS 2 must be configured to not allow passwords that include more than four repeating or sequential characters.V-276382MEDIUMApple visionOS 2 must be configured to lock the display after 15 minutes (or fewer) of inactivity.V-276383MEDIUMApple visionOS 2 must be configured to not allow more than 10 consecutive failed authentication attempts.V-276384HIGHApple visionOS 2 must be configured to enforce a passcode reuse prohibition of at least two generations.V-276385MEDIUMApple visionOS 2 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].V-276386MEDIUMApple visionOS 2 must be configured to not display notifications when the device is locked.V-276387LOWApple visionOS 2 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.V-276388MEDIUMApple visionOS 2 must not allow non-DOD applications to access DOD data.V-276389MEDIUMApple visionOS 2 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.V-276390MEDIUMApple visionOS 2 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.V-276391MEDIUMApple visionOS 2 must be configured to disable ad hoc wireless client-to-client connection capability.V-276392HIGHApple visionOS 2 must require a valid password be successfully entered before the mobile device data is unencrypted.V-276393LOWApple visionOS 2 must implement the management setting: not allow automatic completion of Safari browser passcodes.V-276394LOWApple visionOS 2 must implement the management setting: not allow use of Handoff.V-276395MEDIUMApple visionOS 2 must implement the management setting: disable Allow MailDrop.V-276396HIGHVision Pro must have the latest available visionOS operating system installed.V-276397MEDIUMApple visionOS 2 must implement the management setting: use Secure Sockets Layer (SSL) for Exchange ActiveSync.V-276398MEDIUMApple visionOS 2 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple visionOS 2 Mail app.V-276399MEDIUMApple visionOS 2 must implement the management setting: treat AirDrop as an unmanaged destination.V-276400MEDIUMApple visionOS 2 users must complete required training.V-276401MEDIUMA managed photo app must be used to take and store work-related photos.V-276402LOWApple visionOS 2 must not allow managed apps to write contacts to unmanaged contacts accounts.V-276403LOWApple visionOS 2 must not allow unmanaged apps to read contacts from managed contacts accounts.V-276404MEDIUMApple visionOS 2 must implement the management setting: disable AirDrop.V-276405MEDIUMApple visionOS 2 must disable "Password AutoFill" in browsers and applications.V-276406MEDIUMApple visionOS 2 must disable password sharing.V-276407MEDIUMThe Apple visionOS 2 must be supervised by the MDM.V-276408LOWThe Apple visionOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.V-276409MEDIUMApple visionOS must implement the management setting: not allow a user to remove Apple visionOS configuration profiles that enforce DOD security requirements.V-276410MEDIUMApple visionOS 2 must disable "Allow network drive access in Files access".V-276411MEDIUMApple visionOS 2 must disable connections to Siri servers for the purpose of dictation.V-276412MEDIUMApple visionOS 2 must disable copy/paste of data from managed to unmanaged applications.V-276413MEDIUMApple visionOS 2 must have DOD root and intermediate PKI certificates installed.V-276414MEDIUMApple visionOS 2 must disable ChatGPT connection for Apple Intelligence.V-276415MEDIUMApple visionOS 2 must disable the download of visionOS beta updates.V-276416LOWApple Vision Pro hardware must not be modified to use the Developer Strap unless use is approved on a case-by-case basis by the authorizing official (AO).V-276417MEDIUMApple visionOS 2 must disable the ability of the user to wipe the device.V-276418LOWApple visionOS 2 must disable the use voice assistant (Siri) unless required to meet Section 508 compliance requirements.V-276419LOWApple visionOS 2 must disable Apple Intelligence feature: Image Generation.V-276420LOWApple visionOS 2 must disable Apple Intelligence feature: generate new Genmoji.V-276421MEDIUMDOD Apple visionOS 2 devices must have a Mobile Threat Detection (MTD) app installed.V-276422LOWDOD Apple visionOS 2 devices must disable screenshots and screen recordings.V-279327MEDIUMApple visionOS 2 must implement the management setting: disable the Bluetooth radio.