Requirement text: AC.2.011: Authorize wireless access prior to allowing such connections.
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Establishing usage restrictions and configuration/connection requirements for wireless
access to the system provides criteria for organizations to support wireless access
authorization decisions. Such restrictions and requirements reduce the susceptibility to
unauthorized access to the system through wireless technologies. Wireless networks use
authentication protocols which provide credential protection and mutual authentication.
CMMC CLARIFICATION
You should base the use of wireless technologies on approved guidelines from management.
These guidelines may include the following:
• types of devices, such as corporate or privately-owned equipment;
• configuration requirements of the devices; and
• authorization requirements before granting such connections.
Example
Your company is implementing a wireless network at their headquarters. You work with
management to draft policies about the use of the wireless network. You allow only
company-approved devices that contain verified security configuration settings. Also, you
write usage restrictions to follow for anyone who wants to use the wireless network.
REFERENCES
• NIST SP 800-171 Rev 1 3.1.16
• CIS Controls v7.1 15.1, 15.10
• NIST CSF v1.1 PR.PT-4
• CERT RMM v1.2 TM:SG2.SP2
• NIST SP 800-53 Rev 4 AC-18