03.01.16: Wireless Access Authorization

Beyond CMMC Level 1

The free web app covers the 17 CMMC Level 1 practices. This requirement is part of the full NIST 800-171 set — get the desktop app to work on all 110 requirements with SPRS scoring. Previously saved data is shown read-only below, and your data always remains exportable in full.

Get the desktop app

Security Requirements for 03.01.16 Wireless Access Authorization

Establishing usage restrictions and configuration/connection requirements for wireless access to the system provides criteria for organizations to support wireless access authorization decisions. Such restrictions and requirements reduce the susceptibility to unauthorized access to the system through wireless technologies. Wireless networks use authentication protocols which provide credential protection and mutual authentication.[SP 800-97] provide guidance on secure wireless networks.

Assessment GuidanceExamine 0/9

How an assessor determines this requirement is met. Source: CMMC Assessment Guide – Level 2, Version 2.13 (NIST SP 800-171 Rev. 2).

Discussion

Guidelines from management form the basis for the requirements that must be met prior to authorizing a wireless connection. These guidelines may include the following:

types of devices, such as corporate or privately owned equipment; configuration requirements of the devices; and

authorization requirements before granting such connections.

AC.L2-3.1.16, AC.L2-3.1.17, and AC.L2-3.1.18 are complementary requirements in that they all establish control for the connection of mobile devices and wireless devices through the use of authentication, authorization, and encryption mechanisms.

Examples

Example 1
Your company is implementing a wireless network at its headquarters. CUI may be transmitted on this network. You work with management to draft a policy about the use of the wireless network. The policy states that only company-approved devices that contain verified security configuration settings are allowed to connect. The policy also includes usage restrictions that must be followed for anyone who wants to use the wireless network. Authorization is required before devices are allowed to connect to the wireless network [b].

Assessment Methods

Examine

The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, procedures, plans, system designs, mechanisms) to facilitate understanding, achieve clarification, or obtain evidence.Example: An assessor reads the access control policy and inspects system configuration settings to confirm they match.

Not all of the evidence listed is required to meet this requirement — check the items your organization has collected.

Access control policy
Configuration management plan
Procedures addressing wireless access implementation and usage (including restrictions)
System security plan
System design documentation
System configuration settings and associated documentation
Wireless access authorizations
System audit logs and records
Other relevant documents or records

Interview

The process of holding discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence.Example: An assessor asks a system administrator to describe how user accounts are approved, reviewed, and disabled.

Personnel with responsibilities for managing wireless access connections
Personnel with information security responsibilities

Test

The process of exercising assessment objects (e.g., activities, mechanisms) under specified conditions to compare actual behavior with expected behavior.Example: An assessor attempts to sign in with a disabled account to confirm that access is denied.

Wireless access management capability for the system

Potential Assessment Considerations

Is an updated list of approved network devices providing wireless access to the system maintained [a]?
Are network devices providing wireless access configured to require users or devices be authorized prior to permitting a wireless connection [b]?
Is wireless access to the system authorized and managed [b]?

Key References

NIST SP 800-171 Rev. 2 3.1.16

Overview