Navigate

AC-18

AC-18: Wireless Access

a: Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and

b: Authorize each type of wireless access to the system prior to allowing such connections.

Supplemental

Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
CMMC, Classified, DAF Baseline, Int-A, Int-B, Int-C

CSF Categories
PR.PT-4

Related Controls

The controls below (if any) were marked by NIST as being related to AC-18.

Control	Description
AC-2	a: Define and document the types of accounts allowed and specifically prohibited for use within the system; b: Assign account managers; c: Require [prerequisites and criteria for group and role membership are defined;] for group and role membership; d: Specify: 1: Authorized users of the system; 2: Group and role membership; and 3: Access authorizations (i.e., privileges) and [attributes (as required) for each account are defined;] for each account; e: Require approvals by [personnel or roles required to approve requests to create accounts is/are defined;] for requests to create accounts; f: Create, enable, modify, disable, and remove accounts in accordance with [policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined;]; g: Monitor the use of accounts; h: Notify account managers and [personnel or roles to be notified is/are defined;] within: 1: [time period within which to notify account managers when accounts are no longer required is defined;] when accounts are no longer required; 2: [time period within which to notify account managers when users are terminated or transferred is defined; ] when users are terminated or transferred; and 3: [time period within which to notify account managers when system usage or the need to know changes for an individual is defined;] when system usage or need-to-know changes for an individual; i: Authorize access to the system based on: 1: A valid access authorization; 2: Intended system usage; and 3: [attributes needed to authorize system access (as required) are defined;]; j: Review accounts for compliance with account management requirements [the frequency of account review is defined;]; k: Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l: Align account management processes with personnel termination and transfer processes.
AC-3	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-17	a: Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorize each type of remote access to the system prior to allowing such connections.
AC-19	a: Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b: Authorize the connection of mobile devices to organizational systems.
CA-9	a: Authorize internal connections of [system components or classes of components requiring internal connections to the system are defined;] to the system; b: Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; c: Terminate internal system connections after [conditions requiring termination of internal connections are defined;] ; and d: Review [frequency at which to review the continued need for each internal connection is defined;] the continued need for each internal connection.
CM-7	a: Configure the system to provide only [mission-essential capabilities for the system are defined;] ; and b: Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [one of ].
IA-2	Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
IA-3	Uniquely identify and authenticate [devices and/or types of devices to be uniquely identified and authenticated before establishing a connection are defined;] before establishing a [one or more of "local"/"remote"/"network"] connection.
IA-8	Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
PL-4	a: Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b: Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system; c: Review and update the rules of behavior [frequency for reviewing and updating the rules of behavior is defined;] ; and d: Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [one or more of "{{ insert: param, pl-04_odp.03 }} "/"when the rules are revised or updated"].
SC-40	Protect external and internal [one of ] from the following signal parameter attacks: [one of ].
SC-43	a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and b: Authorize, monitor, and control the use of such components within the system.
SI-4	a: Monitor the system to detect: 1: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives to detect attacks and indicators of potential attacks on the system are defined;] ; and 2: Unauthorized local, network, and remote connections; b: Identify unauthorized use of the system through the following techniques and methods: [techniques and methods used to identify unauthorized use of the system are defined;]; c: Invoke internal monitoring capabilities or deploy monitoring devices: 1: Strategically within the system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Analyze detected events and anomalies; e: Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f: Obtain legal opinion regarding system monitoring activities; and g: Provide [system monitoring information to be provided to personnel or roles is defined;] to [personnel or roles to whom system monitoring information is to be provided is/are defined;] [one or more of "as needed"/"{{ insert: param, si-04_odp.06 }} "].

Enhancements

The controls below (if any) add on to the requirements of AC-18.

Control	Description
AC-18(1)	Protect wireless access to the system using authentication of [one or more of "users"/"devices"] and encryption.
AC-18(2)
AC-18(3)	Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
AC-18(4)	Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
AC-18(5)	Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

Related CCIs

The CCIs below are tied to AC-18.

CCI	Definition
CCI-001439	Establish implementation guidance for wireless access.
CCI-001441	Authorize each type of wireless access to the system prior to allowing such connections.
CCI-002323	Establish configuration requirements and connection requirements for wireless access.