Apple visionOS 2 STIG

16 items · Security · Medium difficulty · 2 hours

Harden Vision Pro devices with the essential Apple visionOS 2 STIG tasks.

• Set Vision Pro devices to supervised mode

  Supervision is required for DOD/managed deployments to enable advanced MDM controls.

• Use Automated Device Enrollment (ABM) to supervise during activation

  Prefer ABM for bulk enrollment and persistent supervision.

• Use Apple Configurator (AC2) to place devices in supervised mode

  Use AC2 when ABM enrollment is not available or for manual supervision.

• Configure and deploy MDM profiles to managed devices

  Include device restrictions, certificates, and compliance settings.

• Prevent users from removing the management (MDM) profile

  Lock removal to maintain enforced policies and device compliance.

• Disable Vision Pro Developer Mode on managed devices

  Developer Mode increases risk; disallow for institutional deployments.

• Disable Guest User mode on managed devices

  Guest accounts can bypass controls; disallow where sensitive data is present.

• Prohibit installing or using the Vision Pro developer strap

  Restrict developer hardware that could bypass device protections.

• Restrict App Store access and unapproved app installations

  Require AO approval for unmanaged/personal apps that may store DOD data.

• Document and enforce AO approvals for unmanaged app use

  Record approvals and any imposed restrictions for auditability.

• Train users not to enable Developer Mode, Guest User, or dev strap

  Include these prohibitions in user onboarding and refresher training.

• Add developer/guest prohibitions to the Vision Pro User Agreement

  Make forbidden behaviors part of the device terms of use.

• Ensure Wi‑Fi networks comply with the Network Infrastructure STIG before connecting devices

  Verify access points and bridges are not directly on enclave networks.

• Limit Vision Pro deployments to COPE and COBO use cases

  Scope device ownership and allowed usage consistent with the STIG.

• Provide procurement instructions to suppliers to include ABM customer number

  Ensure resellers register devices to your ABM account at purchase time.

• Maintain and review the official STIG documents from the DOD Cyber Exchange

  Keep copies and check for updates on cyber.mil or public.cyber.mil.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.