3.1.17 — Lock Down the Wi-Fi
What It Says
Section titled “What It Says”Protect wireless access using authentication and encryption.
What It Actually Means
Section titled “What It Actually Means”Two protections working together:
Authentication — every user proves their identity before connecting. Options from weakest to strongest:
- WPA2-PSK (shared password) — acceptable for small teams but change it when anyone leaves
- WPA2-Enterprise with RADIUS — each user authenticates individually. Preferred.
- WPA3 — strongest option where supported
Encryption — all wireless traffic is encrypted. If your wireless network carries CUI traffic, the encryption must be FIPS 140 validated (not just using an approved algorithm — the actual module must be validated).
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Is wireless access protected by authentication? | Users prove identity before connecting |
| 2 | Is wireless access protected by encryption? | All wireless traffic is encrypted |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: Access control policy, wireless implementation procedures, system security plan, system config, audit logs
People they’ll talk to: Sysadmins, information security staff, system developers
Live demos they’ll ask for: “Show me the wireless authentication method. Show me the encryption configuration.”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”These are the actual questions. Have answers ready.
- “Is wireless access limited to authenticated and authorized users?”
- “If using PSK, is access to the key restricted to authorized users only?”
- “Is wireless encryption FIPS-validated? Show me the validation — the module, not just the algorithm.”
Where Companies Trip Up
Section titled “Where Companies Trip Up”Shared password that never rotates. WPA2-PSK password known by current and former employees. If you use PSK, change it on every departure.
Right algorithm, unvalidated module. Using AES but the access point firmware isn’t FIPS 140 validated.
Guest and corporate on same SSID. No separation between guest wireless and CUI-carrying traffic.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.1.16 — Wi-Fi Approval First | Authorization before this control protects |
| 3.13.11 — FIPS or It Doesn’t Count | FIPS validation requirement for encryption |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: AC.L2-3.1.17 | SPRS Weight: 5 points | POA&M Eligible: No