AC.L2-3.1.18
Mobile Device Connection
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.18 in the reference catalog with its NIST cross-references
Official requirement
Control connection of mobile devices.
Assessment objectives
a. mobile devices that process, store, or transmit CUI are identified;
b. mobile device connections are authorized; and
c. mobile device connections are monitored and logged.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control which mobile devices can connect to the system.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your organization has a policy stating that all mobile devices, including iPads, tablets, mobile phones, and Personal Digital Assistant s (PDAs), must be approved and registered with the IT department before connecting to the network that contains CUI. The IT department uses a Mobile Device Management solution to monitor mobile devices and enforce policies across the enterprise [b,c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; authorizations for mobile device connections to organizational systems; procedures addressing access control for mobile device usage (including restrictions); system design documentation; configuration management plan; system security plan; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Allowing unmanaged phones or tablets because the user already has an account.