1. Home
  2. FedRAMP
  3. AC-18

BRACKETOLOGY | FEDRAMP

AC-18: WIRELESS ACCESS

  • FedRAMP Baseline Membership AC-18:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization:

    • a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
    • b. Authorizes wireless access to the information system prior to allowing such connections.

SUPPLEMENTAL GUIDANCE

Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

CONTROL ENHANCEMENTS

AC-18 (1) WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION
  • FedRAMP Baseline Membership AC-18 (1):
  • MODERATE
  • HIGH

The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a Low Impact system.

There are no FedRAMP-specific requirements if this control is used for a Moderate Impact system.

There are no FedRAMP-specific requirements if this control is used for a High Impact system.


Supplemental Guidance: NONE

RELATED CONTROLS: AC-18 (1)

AC-18 (2) WIRELESS ACCESS | MONITORING UNAUTHORIZED CONNECTIONS

[Withdrawn: Incorporated into SI-4].

AC-18 (3) WIRELESS ACCESS | DISABLE WIRELESS NETWORKING
  • FedRAMP Baseline Membership AC-18 (3):
  • HIGH

The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.

Supplemental Guidance: NONE

RELATED CONTROLS: AC-18 (3)

AC-18 (4) WIRELESS ACCESS | RESTRICT CONFIGURATIONS BY USERS
  • FedRAMP Baseline Membership AC-18 (4):
  • HIGH

The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.

Supplemental Guidance:

Organizational authorizations to allow selected users to configure wireless networking capability are enforced in part, by the access enforcement mechanisms employed within organizational information systems.

RELATED CONTROLS: AC-18 (4)

AC-18 (5) WIRELESS ACCESS | ANTENNAS/TRANSMISSION POWER LEVELS
  • FedRAMP Baseline Membership AC-18 (5):
  • HIGH

The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.

Supplemental Guidance:

Actions that may be taken by organizations to limit unauthorized use of wireless communications outside of organization-controlled boundaries include, for example: (i) reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be used by adversaries outside of the physical perimeters of organizations; (ii) employing measures such as TEMPEST to control wireless emanations; and (iii) using directional/beam forming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational information systems as well as other systems that may be operating in the area.

RELATED CONTROLS: AC-18 (5)

REFERENCES:

  • NIST Special Publication 800-48
  • NIST Special Publication 800-94
  • NIST Special Publication 800-97