---
title: 'visionOS 27.0: Security Configuration - cnssi-1253_high'
description: |-
  This guide describes the actions to take when securing a visionOS 27.0 system against the cnssi-1253_high security benchmark.

  Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.
authors:
  - name: Bob Gendler
    organization: National Institute of Standards and Technology
  - name: Dan Brodjieski
    organization: National Aeronautics and Space Administration
  - name: Allen Golbig
    organization: Jamf
  - name: Rob Lamb
    organization: Los Alamos National Laboratory
  - name: Ekkehard Koch
    organization: ''
parent_values: recommended
platform:
  os: visionOS
  version: 27.0
profile:
  - section: iCloud
    rules:
      - icloud_backup_disabled
      - icloud_drive_disable
      - icloud_keychain_disable
      - icloud_managed_apps_store_data_disabled
      - icloud_photos_disable
      - icloud_private_relay_disable
  - section: Operating System
    rules:
      - os_account_modification_disable
      - os_airdrop_disable
      - os_airdrop_unmanaged_destination_enable
      - os_allow_contacts_read_managed_sources_unmanaged_destinations_disable
      - os_allow_contacts_write_managed_sources_unmanaged_destinations_disable
      - os_allow_documents_managed_sources_unmanaged_destinations_disable
      - os_allow_documents_unmanaged_sources_managed_destinations_disable
      - os_allow_prerelease_disable
      - os_authentication_password_autofill_enable
      - os_default_browser_modification_disable
      - os_diagnostics_reports_disable
      - os_disallow_enterprise_app_trust
      - os_erase_contents_and_settings_disable
      - os_external_intelligence_integration_disable
      - os_external_intelligence_integration_sign_in_disable
      - os_files_network_drive_access_disable
      - os_force_date_and_time_enable
      - os_genmoji_disable
      - os_handoff_disable
      - os_image_playground_disable
      - os_image_wand_disable
      - os_install_configuration_profile_disable
      - os_install_vpn_configuration_disable
      - os_mail_maildrop_disable
      - os_mail_move_messages_disable
      - os_mail_smart_reply_disable
      - os_mail_summary_disable
      - os_on_device_dictation_enforce
      - os_password_autofill_disable
      - os_password_sharing_disable
      - os_personalized_advertising_disable
      - os_require_managed_pasteboard_enforce
      - os_safari_password_autofill_disable
      - os_safari_reader_summary_disable
      - os_screenshots_disable
      - os_user_app_installation_prohibit
      - os_user_ui_app_installation_prohibit
      - os_writing_tools_disable
  - section: Password Policy
    rules:
      - pwpolicy_account_lockout_enforce
      - pwpolicy_force_pin_enable
      - pwpolicy_history_enforce
      - pwpolicy_max_inactivity_enforce
      - pwpolicy_minimum_length_enforce
      - pwpolicy_simple_sequence_disable
  - section: System Settings
    rules:
      - system_settings_biometric_disable
      - system_settings_siri_disable
