Checklist Summary:

The Apple visionOS 2 Security Technical Implementation Guide (STIG) provides the technical security policies, requirements, and implementation details for applying security concepts to Apple devices running visionOS 2 that process, store, or transmit unclassified data marked as Controlled Unclassified Information (CUI) or below. The STIG is based on the Protection Profile for Mobile Device Fundamentals (MDFPP) version 3.3 STIG Template. Requirements compliance is achieved by leveraging a combination of configuration profiles, user-based enforcement (UBE), and reporting. Note: This STIG requires Vision Pro users be trained to not implement the Vision Pro Developer Mode or Guest User mode and to not install and use the Vision Pro developer strap. In addition, these use prohibitions should be added to the Vision Pro User Agreement. The scope of this STIG covers only the Corporate Owned Personally Enabled (COPE) and Corporate Owned Business Only (COBO)1 use cases. The configuration requirements and controls implemented by this STIG allow the user unrestricted activity in downloading and installing personal (unmanaged) apps and data (music, photos, etc.) with authorizing official (AO) approval and within any restrictions imposed by the AO. Note: If the AO has approved the use/storage of DOD data in one or more personal (unmanaged) apps, allowing unrestricted user activity in downloading and installing personal (unmanaged) apps on the Vision Pro device may not be warranted due to the risk of possible loss of or unauthorized access to DOD data. This STIG assumes that if a DOD Wi-Fi network allows a Vision Pro device to connect to a DOD network, the Wi-Fi network complies with the Network Infrastructure STIG; for example, wireless access points and bridges must not be connected directly to the enclave network. Supervision of visionOS provides the administrator more control of a Vision Pro device than is available for an unsupervised device, is required for all DOD Vision Pro deployments. Supervised mode is intended for institutionally owned devices. Supervised mode provides the DOD more control over managed visionOS by providing access to additional device management controls, including disabling a user from modifying installed accounts, removing the management profile (MDM profile), accessing the Apple App Store, and installing new versions of visionOS. A device can be supervised using one of two methods: it can be enrolled in Apple’s Automated Device Enrollment/Apple Business Management (ABM) and supervised during the activation of the device, or a Vision Pro can be placed in supervised mode by using the Apple Configurator (AC2) tool. Automated Device Enrollment registration of a Vision Pro can occur if the device is purchased directly from Apple (Apple Government Team or Apple’s Retail Business Team), an Apple authorized reseller, or manually via AC2. The DOD procurement office must provide the third-party reseller with the agency’s ABM customer number, which can be obtained by applying at http://deploy.apple.com as a business.

Checklist Role:

• Operating System

Known Issues:

Not provided.

Target Audience:

Parties within the DOD and federal government’s computing environments can obtain the applicable STIG from the DOD Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DOD Certificates can obtain the STIG from https://public.cyber.mil/.

Target Operational Environment:

• Managed
• Standalone

Testing Information:

Not provided.

Regulatory Compliance:

Department of Defense Instruction (DODI) 8500.01 requires that “all IT [information technology] that receives, processes, stores, displays, or transmits DOD information will be […] configured […] consistent with applicable DOD cybersecurity policies, standards, and architectures.” The instruction tasks that DISA “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs), and mobile code risk categories and usage guides that implement and are consistent with DOD cybersecurity policies, standards, architectures, security controls, and validation procedures, with the support of the NSA/CSS [National Security Agency/Central Security Service], using input from stakeholders, and using automation whenever possible.” This document is provided under the authority of DODI 8500.01.

Comments/Warnings/Miscellaneous:

All Mobile Device Fundamentals Protection Profile (MDFPP) and DOD Annex security functional requirements (SFRs) were considered while developing this STIG. In DOD environments, devices must implement SFRs as specified in the DOD Annex to the MDFPP. Requirements that are applicable and configurable are included in this STIG.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

[email protected]

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Created New Checklist - 12/17/2025

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 12/17/2025