Navigate

AC-18

AC-18: Wireless Access

The organization:

AC-18a.: Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

AC-18b.: Authorizes wireless access to the information system prior to allowing such connections.

Supplemental

Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to AC-18.

Control	Description
AC-2	The organization: AC-2a.: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; AC-2b.: Assigns account managers for information system accounts; AC-2c.: Establishes conditions for group and role membership; AC-2d.: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; AC-2e.: Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts; AC-2f.: Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; AC-2g.: Monitors the use of information system accounts; AC-2h.: Notifies account managers: AC-2h.1.: When accounts are no longer required; AC-2h.2.: When users are terminated or transferred; and AC-2h.3.: When individual information system usage or need-to-know changes; AC-2i.: Authorizes access to the information system based on: AC-2i.1.: A valid access authorization; AC-2i.2.: Intended system usage; and AC-2i.3.: Other attributes as required by the organization or associated missions/business functions; AC-2j.: Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and AC-2k.: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-17	The organization: AC-17a.: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and AC-17b.: Authorizes remote access to the information system prior to allowing such connections.
AC-19	The organization: AC-19a.: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and AC-19b.: Authorizes the connection of mobile devices to organizational information systems.
CA-3	The organization: CA-3a.: Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements; CA-3b.: Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and CA-3c.: Reviews and updates Interconnection Security Agreements [Assignment: organization-defined frequency].
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: CA-7a.: Establishment of [Assignment: organization-defined metrics] to be monitored; CA-7b.: Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring; CA-7c.: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; CA-7d.: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; CA-7e.: Correlation and analysis of security-related information generated by assessments and monitoring; CA-7f.: Response actions to address results of the analysis of security-related information; and CA-7g.: Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
CM-8	The organization: CM-8a.: Develops and documents an inventory of information system components that: CM-8a.1.: Accurately reflects the current information system; CM-8a.2.: Includes all components within the authorization boundary of the information system; CM-8a.3.: Is at the level of granularity deemed necessary for tracking and reporting; and CM-8a.4.: Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and CM-8b.: Reviews and updates the information system component inventory [Assignment: organization-defined frequency].
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-3	The information system uniquely identifies and authenticates [Assignment: organization-defined specific and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.
IA-8	The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
PL-4	The organization: PL-4a.: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; PL-4b.: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; PL-4c.: Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and PL-4d.: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
SI-4	The organization: SI-4a.: Monitors the information system to detect: SI-4a.1.: Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and SI-4a.2.: Unauthorized local, network, and remote connections; SI-4b.: Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods]; SI-4c.: Deploys monitoring devices: SI-4c.1.: Strategically within the information system to collect organization-determined essential information; and SI-4c.2.: At ad hoc locations within the system to track specific types of transactions of interest to the organization; SI-4d.: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; SI-4e.: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; SI-4f.: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and SI-4g.: Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

Enhancements

The controls below (if any) add on to the requirements of AC-18.

Control	Description
AC-18 (1)	The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
AC-18 (2)	[Withdrawn: Incorporated into SI-4].
AC-18 (3)	The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
AC-18 (4)	The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
AC-18 (5)	The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.

Related CCIs

The CCIs below are tied to AC-18.

CCI	Definition
CCI-001438	The organization establishes usage restrictions for wireless access.
CCI-001439	The organization establishes implementation guidance for wireless access.
CCI-001441	The organization authorizes wireless access to the information system prior to allowing such connections.
CCI-002323	The organization establishes configuration/connection requirements for wireless access.