AC.L2-3.1.17
Wireless Access Protection
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.17 in the reference catalog with its NIST cross-references
Official requirement
Protect wireless access using authentication and encryption.
Assessment objectives
a. wireless access to the system is protected using authentication; and
b. wireless access to the system is protected using encryption.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Protect wireless access with authentication and encryption.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage the wireless network at a small company and are installing a new wireless solution that may transmit CUI. You start by selecting a product that employs encryption validated against the FIPS 140 standard. You configure the wireless solution to use WPA2, requiring users to enter a pre-shared key to connect to the wireless network [a,b]. Example 2 You manage the wireless network at a large company and are installing a new wireless solution that may transmit CUI. You start by selecting a product that employs encryption that is validated against the FIPS 140 standard. Because of the size of your workforce, you configure the wireless system to authenticate users with a RADIUS server. Users must provide the wireless system with their domain usernames and passwords to b e able to connect, and the RADIUS server verifies those credentials. Users unable to authenticate are denied access [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; system design documentation; procedures addressing wireless implementation and usage (including restrictions); system security plan; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Using encryption without adequate authentication or leaving an alternate wireless network unprotected.