AC-18: Wireless Access

Control Family:

Access Control

CSF v1.1 References:

PF v1.0 References:

Threats Addressed:


Next Version:

Control Statement

The organization:

  1. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
  2. Authorizes wireless access to the information system prior to allowing such connections.

Supplemental Guidance

Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

Control Enhancements

AC-18(1): Authentication And Encryption


  • Moderate
  • High

The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

AC-18(3): Disable Wireless Networking


(Not part of any baseline)

The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.

AC-18(5): Antennas / Transmission Power Levels


  • High

The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.