CMMCpedia
Work with me

Requirements / Access Control (AC)

AC.L2-3.1.16

Wireless Access Authorization

Official Source Material

SPRS score value
5 points.
POA&M eligibility
Not eligible. It is worth more than 1 point.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Authorize wireless access prior to allowing such connections.

Determine if:

  1. [a] wireless access points are identified; and
  2. [b] wireless access is authorized prior to allowing such connections.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Objective [a] is an inventory and [b] is an approval gate in front of it.

List the wireless access points and networks in scope, and require authorization before any user or device connects. Policy names who approves and what qualifies, and configuration enforces it. The pairing to show an assessor is the current access point list next to the mechanism that keeps unapproved devices off.

WPA2 with a pre-shared key, one WiFi password shared by everyone, clears this requirement.

Authentication and encryption at the access point are what matter here. Certificate-based onboarding and 802.1X, the per-user network logon standard, are stronger and serve IA.L2-3.5.2 well. They are not the bar for AC.L2-3.1.16, and building a RADIUS authentication server solely for this requirement is effort spent past the objective.

Provision the key so users never learn it.

IT joins devices to the wireless during setup, or the device management platform pushes the WiFi profile. Authorization and connection then become the same controlled event, and the pre-shared key stops circulating on whiteboards. Rotate a shared key whenever someone who knows it leaves, which is also the reason larger teams outgrow shared keys.

No wireless does not mean not applicable.

If wireless is disabled or was never deployed, write the requirement as met: policy prohibits wireless access and configuration enforces the prohibition. That answer is verifiable. A not-applicable claim invites a scoping argument you do not need.

Edge cases

  • A guest network with no path into in-scope systems is not a wireless access point to your system. Keep it segmented and say so.
  • A laptop on hotel or home WiFi is not connecting to your wireless, and is instead using external wireless as transport into your remote access controls. That scenario is governed by AC.L2-3.1.12 through AC.L2-3.1.14, and the tunnel or TLS session carries the protection.

Over-engineering

  • A wireless intrusion prevention system to hunt for rogue access points. Objective [a] is an inventory of the access points you operate, kept honest by the controller view or a walk-through.
  • An approval workflow for every device that joins the wireless network. Objective [b] authorizes wireless access, which a documented approval and a key users never see already does.