Apple visionOS 2 Security Technical Implementation Guide

Version: 1

Updated: 03 Dec 2025

Findings: 50

Findings

V-276374 - Apple visionOS 2 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis]. (low)
V-276375 - Apple visionOS 2 must not allow backup to remote systems (iCloud). (medium)
V-276376 - Apple visionOS 2 must not allow backup to remote systems (iCloud document and data synchronization). (medium)
V-276377 - Apple visionOS 2 must not allow backup to remote systems (iCloud Keychain). (medium)
V-276378 - Apple visionOS 2 must not allow backup to remote systems (Cloud Photo Library). (medium)
V-276379 - Apple visionOS 2 must not allow backup to remote systems (managed applications data stored in iCloud). (medium)
V-276380 - Apple visionOS 2 must be configured to enforce a minimum password length of six characters. (medium)
V-276381 - Apple visionOS 2 must be configured to not allow passwords that include more than four repeating or sequential characters. (medium)
V-276382 - Apple visionOS 2 must be configured to lock the display after 15 minutes (or fewer) of inactivity. (medium)
V-276383 - Apple visionOS 2 must be configured to not allow more than 10 consecutive failed authentication attempts. (medium)
V-276384 - Apple visionOS 2 must be configured to enforce a passcode reuse prohibition of at least two generations. (high)
V-276385 - Apple visionOS 2 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store]. (medium)
V-276386 - Apple visionOS 2 must be configured to not display notifications when the device is locked. (medium)
V-276387 - Apple visionOS 2 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device. (low)
V-276388 - Apple visionOS 2 must not allow non-DOD applications to access DOD data. (medium)
V-276389 - Apple visionOS 2 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM. (medium)
V-276390 - Apple visionOS 2 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM. (medium)
V-276391 - Apple visionOS 2 must be configured to disable ad hoc wireless client-to-client connection capability. (medium)
V-276392 - Apple visionOS 2 must require a valid password be successfully entered before the mobile device data is unencrypted. (high)
V-276393 - Apple visionOS 2 must implement the management setting: not allow automatic completion of Safari browser passcodes. (low)
V-276394 - Apple visionOS 2 must implement the management setting: not allow use of Handoff. (low)
V-276395 - Apple visionOS 2 must implement the management setting: disable Allow MailDrop. (medium)
V-276396 - Vision Pro must have the latest available visionOS operating system installed. (high)
V-276397 - Apple visionOS 2 must implement the management setting: use Secure Sockets Layer (SSL) for Exchange ActiveSync. (medium)
V-276398 - Apple visionOS 2 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple visionOS 2 Mail app. (medium)
V-276399 - Apple visionOS 2 must implement the management setting: treat AirDrop as an unmanaged destination. (medium)
V-276400 - Apple visionOS 2 users must complete required training. (medium)
V-276401 - A managed photo app must be used to take and store work-related photos. (medium)
V-276402 - Apple visionOS 2 must not allow managed apps to write contacts to unmanaged contacts accounts. (low)
V-276403 - Apple visionOS 2 must not allow unmanaged apps to read contacts from managed contacts accounts. (low)
V-276404 - Apple visionOS 2 must implement the management setting: disable AirDrop. (medium)
V-276405 - Apple visionOS 2 must disable "Password AutoFill" in browsers and applications. (medium)
V-276406 - Apple visionOS 2 must disable password sharing. (medium)
V-276407 - The Apple visionOS 2 must be supervised by the MDM. (medium)
V-276408 - The Apple visionOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. (low)
V-276409 - Apple visionOS must implement the management setting: not allow a user to remove Apple visionOS configuration profiles that enforce DOD security requirements. (medium)
V-276410 - Apple visionOS 2 must disable "Allow network drive access in Files access". (medium)
V-276411 - Apple visionOS 2 must disable connections to Siri servers for the purpose of dictation. (medium)
V-276412 - Apple visionOS 2 must disable copy/paste of data from managed to unmanaged applications. (medium)
V-276413 - Apple visionOS 2 must have DOD root and intermediate PKI certificates installed. (medium)
V-276414 - Apple visionOS 2 must disable ChatGPT connection for Apple Intelligence. (medium)
V-276415 - Apple visionOS 2 must disable the download of visionOS beta updates. (medium)
V-276416 - Apple Vision Pro hardware must not be modified to use the Developer Strap unless use is approved on a case-by-case basis by the authorizing official (AO). (low)
V-276417 - Apple visionOS 2 must disable the ability of the user to wipe the device. (medium)
V-276418 - Apple visionOS 2 must disable the use voice assistant (Siri) unless required to meet Section 508 compliance requirements. (low)
V-276419 - Apple visionOS 2 must disable Apple Intelligence feature: Image Generation. (low)
V-276420 - Apple visionOS 2 must disable Apple Intelligence feature: generate new Genmoji. (low)
V-276421 - DOD Apple visionOS 2 devices must have a Mobile Threat Detection (MTD) app installed. (medium)
V-276422 - DOD Apple visionOS 2 devices must disable screenshots and screen recordings. (low)
V-279327 - Apple visionOS 2 must implement the management setting: disable the Bluetooth radio. (medium)