Control: The organisation:
B. Authorises wireless access to the information system prior to allowing such connections.
Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.
Related controls: AC-2, AC-3, AC-17, AC-19, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, PL-4, SI-4.
Wireless Access Control Enhancements:
AC-18 (2) Wireless Access - Monitoring unauthorised connections
[Withdrawn: Incorporated into SI-4].
AC-18 (3) Wireless Access - Disable wireless networking
The organisation disables, when not intended for use, wireless networking capabilities internally
embedded within information system components prior to issuance and deployment.
Supplemental Guidance: Related control: AC-19.
AC-18 (4) Wireless Access - Restrict configurations by users
The organisation identifies and explicitly authorises users allowed to independently configure wireless networking capabilities.
Supplemental Guidance: Organisational authorisations to allow selected users to configure wireless networking capability are enforced in part, by the access enforcement mechanisms employed within organisational information systems.
AC-18 (5) Wireless Access - antennas / transmission power levels
The organisation selects radio antennas and calibrates transmission power levels to reduce the
probability that usable signals can be received outside of organisation-controlled boundaries.
SupplementalGuidance: Actions that maybe taken by organisations to limit unauthorised use of wireless communications outside of organisation-controlled boundaries include, for example:
(i) reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be used by adversaries outside of the physical perimeters of organisations;
(ii) employing measures such as TEMPEST to control wireless emanations; and
(iii) using directional/beam forming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such actions, organisations can conduct periodic wireless surveys to understand the radio frequency profile of organisational information systems as well as other systems that may be operating in the area.
Related control: PE-19.