AC.L2-3.1.16
Wireless Access Authorization
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.16 in the reference catalog with its NIST cross-references
Official requirement
Authorize wireless access prior to allowing such connections.
Assessment objectives
a. wireless access points are identified; and
b. wireless access is authorized prior to allowing such connections.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Approve wireless access before devices establish wireless connections.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company is implementing a wireless network at its headquarters. CUI may be transmitted on this network. You work with management to draft a policy about the use of the wireless network. The policy states that only company -approved devices that contain verified security configuration settings are allowed to connect. The policy also includes usage restrictions that must be followed for anyone who wants to use the wireless network. Authorization is required before devices are allowed to connect to the wireless network [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; configuration management plan; procedures addressing wireless access implementation and usage (including restrictions); system security plan; system design documentation; system configuration settings and associated documentation; wireless access authorizations; system audit logs and records; other relevant documents or records
Common mistakes
Publishing a wireless password without documenting who or what is authorized to connect.