Wireless Access Protection

Official Source Material

Protect wireless access using authentication and encryption.

Determine if:

[a] wireless access to the system is protected using authentication; and
[b] wireless access to the system is protected using encryption.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

One configuration answers both objectives.

WPA2 or WPA3 gives you authentication [a] through the key or enterprise logon and encryption [b] through AES in the same setting. Never run an open network in scope. Open authentication admits anyone and fails [a] outright.

Match the authentication mechanism to your size.

A pre-shared key works for a small, stable team, with rotation on every departure. WPA2 or WPA3 Enterprise against a RADIUS authentication server authenticates each user or device individually and scales past the point where a shared secret is manageable. Both are acceptable. Pick the one you will operate correctly.

Decide which layer protects CUI that crosses the air.

CUI is the controlled unclassified information your contract requires you to protect. Wireless traffic leaves your boundary, so CUI crossing it needs FIPS-validated encryption at some layer of the stack. If every CUI flow already rides a validated layer higher up, a FIPS-mode VPN or TLS to a FedRAMP-authorized service, the WiFi is transport and does not carry the CUI burden. If the wireless link is the only encryption between a laptop and a CUI file share, the WiFi inherits the FIPS question, and consumer-grade access points do not answer it. Trace your CUI data flows before deciding which case you are in. SC.L2-3.13.11 governs the validation itself.

Enterprise authentication does not answer the encryption question.

EAP-TLS, the certificate-based enterprise logon, strengthens how session keys are established, not the validation status of the encryption modules. Treat [a] and [b] as separate accounts: strong authentication on one side, and a deliberate answer on the other for where validated encryption lives.

What falls short

A consumer or small-business access point as the only encryption layer for CUI reaching an internal file server. The wireless link is then responsible for CUI confidentiality without a validated module, which fails [b] as assessed against the guide's FIPS discussion.

Edge cases

An environment with no wireless at all writes this as met by prohibition and configuration, mirroring AC.L2-3.1.16, rather than claiming not applicable.
Remote workers on home WiFi reaching only a FedRAMP-authorized cloud service are covered by that service's validated TLS. Their home access points are outside your boundary and outside this requirement.