STIGQter STIGQter: STIG Summary: Apple visionOS 2 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 13 May 2026:

Apple visionOS must implement the management setting: not allow a user to remove Apple visionOS configuration profiles that enforce DOD security requirements.

DISA Rule

SV-276409r1146723_rule

Vulnerability Number

V-276409

Group Title

PP-MDF-993300

Rule Version

AVOS-02-013500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Apple visionOS configuration profile so that it can never be removed.

The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider.

When using Apple Configurator, under "General Security", configure "Security" to "Never" and "Automatically Remove Profile" to "Never".

Check Contents

Review configuration settings to confirm configuration profiles are not removable.

This check procedure is performed on both the Apple visionOS management tool and the Apple visionOS device. The procedures below assume the site is not enrolled in Apple's Automatic Device Enrollment and are not applicable to devices under MDM management.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the Apple visionOS management tool, verify "Security" is set to "Never" and "Automatically Remove Profile" is set to "Never".

On the Apple visionOS device:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap each Configuration Profile from the Apple visionOS management tool that contains the restrictions for the device.
5. Verify the "Remove Profile" button is not present.

If on the Apple visionOS management tool or the visionOS device the "Remove Profile" button is available on the configuration profile, this is a finding.

Vulnerability Number

V-276409

Documentable

False

Rule Version

AVOS-02-013500

Severity Override Guidance

Review configuration settings to confirm configuration profiles are not removable.

This check procedure is performed on both the Apple visionOS management tool and the Apple visionOS device. The procedures below assume the site is not enrolled in Apple's Automatic Device Enrollment and are not applicable to devices under MDM management.

Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review.

In the Apple visionOS management tool, verify "Security" is set to "Never" and "Automatically Remove Profile" is set to "Never".

On the Apple visionOS device:
1. Open the Settings app.
2. Tap "General".
3. Tap "VPN & Device Management".
4. Tap each Configuration Profile from the Apple visionOS management tool that contains the restrictions for the device.
5. Verify the "Remove Profile" button is not present.

If on the Apple visionOS management tool or the visionOS device the "Remove Profile" button is available on the configuration profile, this is a finding.

Check Content Reference

M

Target Key

5713