AC-18 Wireless Access

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	4 (4 in a baseline)

Related controls: AC-2, AC-3, AC-17, AC-19, CA-9, CM-7, IA-2, IA-3, IA-8, PL-4, SC-40, SC-43, SI-4

Control statement

• a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
• b. Authorize each type of wireless access to the system prior to allowing such connections.

NIST discussion

Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.

Control enhancements

AC-18(1) Authentication and Encryption

Baselines: Moderate, High

Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

Discussion and assessment objectives for AC-18(1)

Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. To protect systems with wireless access points, strong authentication of users and devices along with strong encryption can reduce susceptibility to threats by adversaries involving wireless technologies.

Determine if:

• AC-18(01)[01] wireless access to the system is protected using authentication of [Selection (one or more): users; devices];
• AC-18(01)[02] wireless access to the system is protected using encryption.

Examine: Access control policy; procedures addressing wireless implementation and usage (including restrictions); system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Mechanisms implementing wireless access protections to the system.

AC-18(3) Disable Wireless Networking

Baselines: Moderate, High

Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.

Discussion and assessment objectives for AC-18(3)

Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Disabling wireless capabilities when not needed for essential organizational missions or functions can reduce susceptibility to threats by adversaries involving wireless technologies.

Determine if when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.

Examine: Access control policy; procedures addressing wireless implementation and usage (including restrictions); system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms managing the disabling of wireless networking capabilities internally embedded within system components.

AC-18(4) Restrict Configurations by Users

Baselines: High

Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.

Discussion and assessment objectives for AC-18(4)

Organizational authorizations to allow selected users to configure wireless networking capabilities are enforced, in part, by the access enforcement mechanisms employed within organizational systems.

Determine if:

• AC-18(04)[01] users allowed to independently configure wireless networking capabilities are identified;
• AC-18(04)[02] users allowed to independently configure wireless networking capabilities are explicitly authorized.

Examine: Access control policy; procedures addressing wireless implementation and usage (including restrictions); system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms authorizing independent user configuration of wireless networking capabilities.

AC-18(5) Antennas and Transmission Power Levels

Baselines: High

Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

Discussion and assessment objectives for AC-18(5)

Actions that may be taken to limit unauthorized use of wireless communications outside of organization-controlled boundaries include reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be captured outside of the physical perimeters of the organization, employing measures such as emissions security to control wireless emanations, and using directional or beamforming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such mitigating actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational systems as well as other systems that may be operating in the area.

Determine if:

• AC-18(05)[01] radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries;
• AC-18(05)[02] transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

Examine: Access control policy; procedures addressing wireless implementation and usage (including restrictions); system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Calibration of transmission power levels for wireless access; radio antenna signals for wireless access; wireless access reception outside of organization-controlled boundaries.

Withdrawn enhancements: AC-18(2).

Assessment objectives (SP 800-53A)

Objectives and methods for AC-18

Determine if:

• AC-18a.
  • AC-18a.[01] configuration requirements are established for each type of wireless access;
  • AC-18a.[02] connection requirements are established for each type of wireless access;
  • AC-18a.[03] implementation guidance is established for each type of wireless access;
• AC-18b. each type of wireless access to the system is authorized prior to allowing such connections.

Examine: Access control policy; procedures addressing wireless access implementation and usage (including restrictions); configuration management plan; system design documentation; system configuration settings and associated documentation; wireless access authorizations; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for managing wireless access connections; organizational personnel with information security responsibilities.

Test: Wireless access management capability for the system.

Policy statement

• The Chief Information Security Officer shall establish configuration requirements, connection requirements and implementation guidance for each type of wireless access. (AC-18a)
• The System owner shall authorize each type of wireless access to the system before allowing such connections. (AC-18b)

AC-18(1) Wireless authentication and encryption

• The System owner shall protect wireless access to the system using authentication of Select one or more: users; devices Typical: users and devices and encryption. (AC-18(1))

AC-18(3) Disable wireless networking

• The System owner shall ensure wireless networking capabilities embedded in system components are disabled before issuance and deployment when not intended for use. (AC-18(3))

AC-18(4) Restrict configurations by users

• The System owner shall identify and explicitly authorize the users allowed to independently configure wireless networking capabilities. (AC-18(4))

AC-18(5) Antennas and transmission power levels

• The System owner shall select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside organization-controlled boundaries. (AC-18(5))

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-18 asks you to decide which kinds of wireless access the system allows, write the rules for each kind, and authorize each one before anyone connects. NIST’s discussion counts Wi-Fi (802.11), Bluetooth, and microwave and packet radio links as wireless. The Moderate baseline adds authentication and encryption for wireless access (AC-18(1)) and disabling embedded wireless that is not meant to be used (AC-18(3)).

Common implementations. An enterprise wireless network that authenticates each user or device against the directory through 802.1X, often with device certificates, and encrypts the traffic (AC-18(1)). A separate guest network with internet-only access, outside the authorization boundary. Device management profiles and build settings that turn off Wi-Fi and Bluetooth on components that do not need them, and firmware settings that disable wireless on servers (AC-18(3)). The approved cryptography for wireless encryption comes from the encryption and key management standard.

For configuration detail, NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (February 2012; final, with no newer revision listed as of September 2026), is NIST’s guide to securing wireless local area networks.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Authentication of users, devices or both (AC-18(1))	Users and devices

AC-18 and AC-18(3) have no parameters. In the Access Control policy, the CISO sets the configuration and connection requirements for each type of wireless access (item a), and the system owner authorizes each type for the system (item b).

Evidence assessors ask for.

• The configuration requirements, connection requirements and implementation guidance for each type of wireless access
• The authorization of each type in the system security plan, including a statement that no wireless is allowed, where that is the case
• Wireless controller or access point configuration showing 802.1X authentication and encryption (AC-18(1))
• Device management or build settings that disable unused radios, and a sample of components checked against them (AC-18(3))
• Results of the last wireless survey or rogue access point scan

Inheritance. The enterprise wireless network is usually a common control, run by the network team. The system owns whether its components may connect wirelessly at all, and disabling the radios on its own components, so AC-18 is often a hybrid control.

Common findings.

• Rogue access points, such as consumer routers plugged into the internal network.
• Wireless networks protected by one pre-shared password known to many users and never changed.
• A guest network with a path into internal networks.
• Laptops or servers with Wi-Fi or Bluetooth left on, where the security plan says the system uses no wireless.
• Printers and other devices broadcasting their own setup networks.

Enhancements in the Moderate baseline. AC-18(1) authentication and encryption and AC-18(3) disable wireless networking. High adds AC-18(4), restricting wireless configuration to users identified and explicitly authorized, and AC-18(5), choosing antennas and transmission power so signals are less likely to be received outside organization-controlled boundaries. Neither has parameters. Wireless intrusion detection is SI-4(14), also High only, set out in the system monitoring standard.

Federal systems (as of September 2026). OMB Circular A-130, Appendix I, section 4.i(14), requires agencies to encrypt all FIPS 199 moderate-impact and high-impact information in transit, unless encrypting is technically infeasible or would demonstrably affect the mission, and the authorizing official accepts the risk with the CIO’s approval. Section 4.i(15) requires validated cryptographic modules. So the encryption that meets AC-18(1) on a Moderate system uses a validated module; SC-13 covers FIPS 140-3 and the validation program.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy