{"data":{"id":"AC-18","name":"Wireless Access","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and\nb. Authorize each type of wireless access to the system prior to allowing such connections.","supplemental_guidance":"Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.","enhancements":[{"id":"AC-18(01)","name":"Authentication and Encryption","statement":"Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.","baselines":["moderate","high"]},{"id":"AC-18(02)","name":"Monitoring Unauthorized Connections","withdrawn":true,"incorporated_into":["SI-04"]},{"id":"AC-18(03)","name":"Disable Wireless Networking","statement":"Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.","baselines":["moderate","high"]},{"id":"AC-18(04)","name":"Restrict Configurations by Users","statement":"Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.","baselines":["high"]},{"id":"AC-18(05)","name":"Antennas and Transmission Power Levels","statement":"Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.","baselines":["high"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-18","name":"Wireless Access","description":"a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and\nb. Authorize each type of wireless access to the system prior to allowing such connections.","discussion":"Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.","related_controls":["AC-02","AC-03","AC-17","AC-19","CA-09","CM-07","IA-02","IA-03","IA-08","PL-04","SC-40","SC-43","SI-04"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Control text drops 'usage restrictions' Adds 'for each type of' wireless access"}},"compliance_mappings":{"iso_27001_2022":["A.5.14","A.8.20"],"iso_27002_2022":[],"cobit_2019":["DSS05"],"pci_dss_v4":["11.2"],"nist_csf_2":["PR.AA-05"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4"],"anssi":["Hygiene.25","Hygiene.26","SecNumCloud.14.3"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.C(62)"],"gdpr":["Art.32(1)(a)","Art.32(1)(b)"],"dora":["Art.9(4)(a)"],"bio2":[],"rbi_csf":["Annex1.4","ITGRCA.19"],"fisc":["FISC.T3","FISC.T10"],"lgpd_bcb":[],"hkma_tme1":["TME1.8.5"],"mlps_2":["8.1.3.1","8.3","8.5"],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbb_tm":["TM-6","TM-8"],"qatar_nia":["AC","CS"],"sama_csf":["3.1","3.3"],"uae_ia":["T8","T9"],"bom_ctrm":["3.2"],"cbe_csf":["CTO-6"],"bot_cyber":["Ch2.4"],"ecb_croe":["CROE.2.3.5"],"ffiec_is":["II.C.9","II.C.15(c)"],"hipaa_sr":["§164.312(e)(1)"],"cmmc_2":["AC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":["J"],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["01.b"],"iso_27799":[],"lloyds_ms":["MS8.9"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions that control which wireless technologies are permitted and monitor wireless usage prevent adversary exfiltration over unauthorized wireless network media by limiting available wireless pathways."},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls enforcing WPA3 encryption, 802.1X authentication, and wireless IDS monitoring reduce network sniffing effectiveness on wireless networks by ensuring traffic is encrypted and unauthorized access points are detected."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Wireless access monitoring and logging that captures wireless connection events provides forensic evidence of adversary wireless activity, making indicator removal less effective when wireless audit trails are centrally preserved."},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions that control device connectivity and data transfer over wireless interfaces limit automated collection by preventing unauthorized wireless-connected devices from systematically harvesting data."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls that restrict network access for wireless clients through network segmentation and conditional access policies limit adversary ability to reach cloud storage from unauthorized wireless connections."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions enforcing encrypted authentication and secure credential transport over wireless networks prevent adversary discovery of unsecured credentials transmitted over unprotected wireless channels."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls—including WPA3, 802.1X, and rogue AP detection—directly counter wireless adversary-in-the-middle attacks by ensuring strong mutual authentication between wireless clients and access points."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions that enforce encrypted Kerberos authentication over wireless networks reduce the risk of Kerberos ticket theft by preventing cleartext ticket capture through wireless network interception."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls enforcing encrypted wireless communication and mutual authentication prevent data manipulation over wireless channels by ensuring transmitted data cannot be intercepted and altered in transit."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions that isolate network management traffic from general wireless networks prevent adversary access to configuration repositories through unauthorized wireless network connections."},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Wireless access policies that disable or restrict Bluetooth on managed devices directly prevent exfiltration over Bluetooth by eliminating the wireless channel adversaries would use for short-range data transfer."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Wireless access monitoring that detects unauthorized wireless bridge configurations and rogue access points prevents adversary traffic duplication by identifying wireless infrastructure used to copy network traffic."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls with centralized wireless event logging ensure that Windows event log clearing on endpoints does not eliminate wireless activity evidence preserved in wireless controller and WIDS infrastructure."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Wireless access monitoring with centralized wireless log collection ensures that Linux/Mac system log clearing does not eliminate wireless connection evidence maintained in wireless infrastructure audit trails."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Wireless access monitoring that captures email access patterns over wireless networks provides additional forensic evidence that persists even when adversaries clear mailbox data to remove traces of their activity."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls enforcing encrypted key exchange and certificate-based wireless authentication protect private key material from interception during wireless authentication handshakes."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions implementing port security and dynamic ARP inspection on wireless infrastructure prevent ARP cache poisoning attacks on wireless network segments."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls enforcing 802.1X with certificate-based authentication, WIDS monitoring, and rogue AP detection directly counter evil twin attacks by validating access point identity before client association."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions enforcing Kerberos traffic encryption over wireless networks prevent silver ticket capture through wireless eavesdropping by ensuring ticket material is protected in transit."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls with encrypted authentication traffic prevent Kerberoasting setup by blocking adversary interception of Kerberos service ticket request-response exchanges over wireless networks."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions ensuring encrypted Kerberos authentication over wireless channels prevent AS-REP roasting by protecting AS-REP responses from wireless network interception."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Wireless access controls enforcing encrypted wireless communication prevent stored data manipulation over wireless channels by ensuring adversaries cannot intercept and modify data written to remote storage."},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions implementing WPA3 encryption and mutual authentication directly prevent transmitted data manipulation over wireless networks by providing cryptographic integrity protection."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Wireless access policies isolating SNMP management traffic from wireless networks prevent adversary SNMP MIB dumps by ensuring network management protocols are not accessible from wireless client segments."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Wireless access restrictions segregating network device management interfaces from wireless client networks prevent adversary configuration dumping by blocking wireless access to management plane services."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-02: iso_27001_2022 clauses taken from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR, v1.0.0). OSA had none. 2026-10-03: nist_csf_2 PR.AA-05 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-006","SP-023","SP-025","SP-026"]}}