Protect wireless access using authentication and encryption
📖 What This Means
This control requires organizations to secure their wireless networks by ensuring that only authorized users can access them and that all data transmitted over the network is encrypted. Think of it like locking the doors to your house and ensuring that conversations inside can't be overheard. Without these protections, unauthorized individuals could easily connect to the network and intercept sensitive information. For example, an employee accessing company email over an unsecured Wi-Fi network could expose login credentials to hackers. Similarly, a contractor using an unprotected wireless printer might accidentally leak confidential documents. By implementing strong authentication and encryption, organizations can prevent these risks and safeguard their data.
🎯 Why It Matters
Unprotected wireless networks are a prime target for attackers, as they provide an easy entry point into an organization's systems. A breach through an insecure Wi-Fi network can lead to data theft, unauthorized access, and even ransomware attacks. For instance, in 2017, hackers exploited a weak wireless network at a major retailer to steal millions of customer credit card details. The financial and reputational damage from such incidents can be devastating. From the DoD/CMMC perspective, protecting wireless access is critical because Controlled Unclassified Information (CUI) often traverses these networks. Failure to secure wireless access can compromise national security and result in non-compliance penalties.
✅ How to Implement
- 1. Use cloud-native wireless security services, such as AWS WAF or Azure Firewall, to enforce authentication and encryption policies.
- 2. Configure cloud-managed wireless access points (e.g., Meraki or Aruba) to require WPA3 encryption and 802.1X authentication.
- 3. Integrate wireless access with cloud-based Identity and Access Management (IAM) solutions like Okta or Azure AD.
- 4. Enable logging and monitoring for wireless access via cloud services like AWS CloudTrail or Azure Monitor.
- 5. Regularly audit wireless configurations using cloud-native tools like AWS Config or Azure Security Center.
📋 Evidence Examples
Wireless Security Policy
Wireless Configuration Screenshots
Access Logs
Penetration Test Report
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AC.L2-3.1.17 ("Protect wireless access using authentication and encryption"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how access to CUI systems is controlled, including the specific IAM tools, policies, and processes used. Reference your Access Control Policy and identify the systems in scope. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AC.L2-3.1.17 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to protect wireless access using authentication and encryption. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AC.L2-3.1.17 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to protect wireless access using authentication and encryption. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AC.L2-3.1.17 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all access points to CUI systems (VPN, direct network, cloud portals)
- • Document which IAM system manages access (Azure AD, AWS IAM, on-prem AD)
- • Map user roles to system access levels
- • Ensure this control covers all systems within your defined CUI boundary where protect wireless access using authentication and encryption applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Access Control Policy
- 📄 IAM configuration documentation
- 📄 Access request and approval records
- 📄 Evidence artifacts specific to AC.L2-3.1.17
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that access controls are implemented as described, test whether unauthorized users are blocked, and review access logs for evidence of enforcement.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Is WPA3 encryption enabled on all wireless access points?
Question 2: Is 802.1X authentication implemented for wireless access?
Question 3: Are wireless networks segmented from critical systems?
Question 4: Are wireless access logs regularly reviewed?
Question 5: Has wireless security been tested in the last year?
⚠️ Common Mistakes (What Auditors Flag)
1. Using outdated encryption protocols like WEP.
2. Failing to implement 802.1X authentication.
3. Not reviewing wireless access logs.
4. Skipping penetration testing.
5. Failing to document wireless security policies.
📚 Parent Policy
This practice is governed by the Access Control Policy