AC-18: Wireless Access
Control Family:
CSF v1.1 References:
PF v1.0 References:
Threats Addressed:
Next Version:
- NIST Special Publication 800-53 Revision 5:
- AC-18: Wireless Access
Control Statement
The organization:
- Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
- Authorizes wireless access to the information system prior to allowing such connections.
Supplemental Guidance
Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.
Control Enhancements
AC-18(1): Authentication And Encryption
Baseline(s):
- Moderate
- High
The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
AC-18(3): Disable Wireless Networking
Baseline(s):
The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
AC-18(4): Restrict Configurations By Users
Baseline(s):
- High
The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
AC-18(5): Antennas / Transmission Power Levels
Baseline(s):
- High
The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.