Security requirement
- a.Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.
- b.Authorize each type of wireless access to the system prior to establishing such connections.
- c.Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment.
- d.Protect wireless access to the system using authentication and encryption.
Discussion
Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. Establishing usage restrictions, configuration requirements, and connection requirements for wireless access to the system provides criteria to support access authorization decisions. These restrictions and requirements reduce susceptibility to unauthorized system access through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication. Organizations authenticate individuals and devices to protect wireless access to the system. Special attention is given to the variety of devices with potential wireless access to the system, including small form factor mobile devices (e.g., smart phones, tablets, smart watches). Wireless networking capabilities that are embedded within system components represent a potential vulnerability that can be exploited by adversaries. Strong authentication of users and devices, strong encryption, and disabling wireless capabilities that are not needed for essential mission or business functions can reduce susceptibility to threats by adversaries involving wireless technologies.
Implementation perspective
Treat Wireless Access as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to approved identities, least privilege, remote access, information flow, and the full account lifecycle.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- access authorization and approval records
- account inventories and entitlement exports
- access review results
- authentication and authorization logs
Common failure patterns
- CUI access that exceeds mission need
- shared or orphaned accounts
- remote access paths outside the approved boundary
- access reviews that cannot be reconciled to deployed permissions
Assessment objectives and methods
Assessment objectives (8)
- a.
each type of wireless access to the system is defined.
- a.
usage restrictions are established for each type of wireless access to the system.
- a.
configuration requirements are established for each type of wireless access to the system.
- a.
connection requirements are established for each type of wireless access to the system.
- b.
each type of wireless access to the system is authorized prior to establishing such connections.
- c.
wireless networking capabilities not intended for use are disabled prior to issuance and deployment.
- d.
wireless access to the system is protected using authentication.
- d.
wireless access to the system is protected using encryption.
Examine
- access control policy and procedures
- procedures for wireless system access
- wireless system access configuration and connection requirements
- configuration management plan
- system configuration settings
- wireless access authorizations
- system audit records
- system design documentation
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for managing wireless access connections
- personnel with information security responsibilities
- system developers
- system administrators
Test
- wireless access management capability for the system
- mechanisms for implementing wireless access protections to the system
- mechanisms for managing the disabling of wireless networking capabilities
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.