Access Control 3.1.16 (3.1.16)

Does your organization use Wi-Fi networks in any location where CUI is accessed or processed?

Are wireless access points present in facilities where employees access CUI systems?

Does every employee need individual approval for wireless access, or can we approve departments or groups?

While group-based authorization is acceptable (such as authorizing all employees in a department), there must still be a documented process showing who approved wireless access for that group and what criteria were used. Individual tracking is preferred for accountability, but group authorization is acceptable if properly documented and periodically reviewed. The key is demonstrating that wireless access is not automatic and requires explicit authorization.

We use a shared Wi-Fi password for our office. Does this satisfy the authorization requirement?

Using a shared password (WPA2-PSK) can satisfy this control only if you have a documented process for who receives the password and maintain records of authorization approvals. However, this is the minimum acceptable implementation and has limitations—you cannot track individual access, easily revoke access for specific users, or audit who connected when. For CMMC Level 2 and higher, individual authentication (WPA2-Enterprise) is strongly preferred and may be required depending on your environment.

Our guest Wi-Fi network is completely separate from our corporate network. Does this control still apply?

If your guest wireless network is truly isolated with no logical or physical connection to systems processing CUI, and you can demonstrate this separation through network architecture documentation, then authorization requirements for the guest network may be reduced. However, you must still control and authorize access to any wireless network that can reach CUI systems. Many assessors will want to verify the isolation is genuine and properly maintained, as misconfigured guest networks are a common security gap.

What happens if our RADIUS server goes down? Can we have a backup that allows access without authorization?

Failover configurations that bypass authorization requirements when the RADIUS server is unavailable typically do not satisfy this control. If you implement a backup authentication method, it must still enforce authorization—for example, failing over to a secondary RADIUS server or requiring VPN access with authorization. Automatically granting wireless access without authorization during outages creates a significant security gap. Your incident response procedures should address RADIUS failures without compromising authorization requirements.

Do we need to re-authorize wireless access periodically, or is one-time authorization sufficient?

The control requires authorization prior to allowing wireless connections, but does not explicitly mandate periodic re-authorization. However, best practice and assessor expectations typically include periodic review of authorized users (at least annually) and immediate revocation when authorization should end (termination, role change). Many organizations tie wireless authorization to annual access reviews required by AC-2. One-time authorization without any review process is generally insufficient, especially for long-term employees.

Can we use MAC address filtering as our wireless authorization method?

MAC address filtering alone is not sufficient because MAC addresses can be spoofed and this method does not provide strong authentication. However, MAC filtering can be used as an additional layer of defense in combination with proper authentication (WPA2/WPA3) and a documented authorization process for registering device MAC addresses. If you use MAC filtering, you must still implement encryption and have documented approval for each MAC address added to the authorized list. This approach is most appropriate for IoT devices or specialized equipment rather than user devices.