STIGQter STIGQter: STIG Summary: Apple visionOS 2 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 13 May 2026:

Apple visionOS 2 must be configured to lock the display after 15 minutes (or fewer) of inactivity.

DISA Rule

SV-276382r1146642_rule

Vulnerability Number

V-276382

Group Title

PP-MDF-333030

Rule Version

AVOS-02-006800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Install a configuration profile to lock the device display after 15 minutes (or fewer) of inactivity. This is done by setting "Maximum Auto-Lock time" and "Grace Period for device lock" so the sum of their values is between 1 and 15 minutes.

Check Contents

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or fewer.

This check procedure is performed on both the Apple visionOS management tool and the Vision Pro.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes.

Alternatively, locate the text "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example:

"<key>maxGracePeriod</key>
<integer>5</integer>
<key>maxInactivity</key>
<integer>5</integer>"

Here, 5 + 5 = 10; this meets the requirement.

On the Vision Pro:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the configuration profile from the visionOS management tool containing the password policy.
5. Tap "Restrictions".
6. Tap "Passcode".
7. Verify the sum of the "Max grace period" and "Max inactivity" values is fewer than 15 minutes.

Note: On some visionOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be fewer than 15. A sum of 16 does not meet the requirement.

On the management server, if the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the visionOS management tool or the sum of the values assigned to "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" is not between 1 and 15 minutes in the configuration profile, or if on the Vision Pro, the sum of the values assigned to "Max grace period" and "Max inactivity" is not between 1 and 15 minutes, this is a finding.

Vulnerability Number

V-276382

Documentable

False

Rule Version

AVOS-02-006800

Severity Override Guidance

Review configuration settings to confirm the screen lock timeout is set to 15 minutes or fewer.

This check procedure is performed on both the Apple visionOS management tool and the Vision Pro.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" is between 1 and 15 minutes.

Alternatively, locate the text "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example:

"<key>maxGracePeriod</key>
<integer>5</integer>
<key>maxInactivity</key>
<integer>5</integer>"

Here, 5 + 5 = 10; this meets the requirement.

On the Vision Pro:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap the configuration profile from the visionOS management tool containing the password policy.
5. Tap "Restrictions".
6. Tap "Passcode".
7. Verify the sum of the "Max grace period" and "Max inactivity" values is fewer than 15 minutes.

Note: On some visionOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be fewer than 15. A sum of 16 does not meet the requirement.

On the management server, if the sum of the "Max grace period" and "Max inactivity" values is not between 1 and 15 minutes in the visionOS management tool or the sum of the values assigned to "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" is not between 1 and 15 minutes in the configuration profile, or if on the Vision Pro, the sum of the values assigned to "Max grace period" and "Max inactivity" is not between 1 and 15 minutes, this is a finding.

Check Content Reference

M

Target Key

5713