AC-18 Wireless access
Requires configuration and connection requirements plus implementation guidance to be established for every type of wireless access, and each wireless access type to be authorized before any wireless connection to the sy
4
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Authorization record for each wireless network or access type in use · Identity provider / directory
- Wireless controller configuration export and site survey or rogue access point scan results · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Wireless standard covering authentication, encryption and connection requirements per access type · Policy repository / GRC workspace
- Register of guest and operational technology wireless segments and their approvals · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Guest wireless deployed by facilities without a security authorization
- Legacy encryption left enabled on an older service set for compatibility
- Rogue and unmanaged access points never scanned for, so unauthorized wireless is invisible
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC-17 Remote access · AC-19 Access control for mobile devices