Wireless Access AC-18

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-18 (Wireless Access) is about setting the rules for every wireless way onto the system — Wi-Fi (wireless local-area networking), Bluetooth, and any other radio — and formally authorizing each type before it is allowed to connect. It has two parts: write down the configuration and connection requirements, plus the implementation guidance, for each kind of wireless access, then approve each kind before it is turned on. It sits in the Low baseline.

What good looks like

• Inventory every wireless radio on the server — Wi-Fi and Bluetooth — so you know what could connect.
• Write down the requirements for each type of wireless: how it must be configured, what may connect, and how it gets set up (the control’s part a).
• Authorize each wireless type before it is allowed — no radio comes on until someone signs off (part b).
• If wireless is not needed — a wired lab server usually is not — turn the radios off entirely. That is the strongest posture and closes enhancement AC-18(3) (Disable Wireless Networking).
• If wireless is used, require strong authentication and encryption — WPA2 or WPA3 (Wi-Fi Protected Access), never open or the broken WEP (Wired Equivalent Privacy) — which is the Moderate-baseline enhancement AC-18(1).

Framework mapping

• NIST CSF 2.0 — PR.AA-05 — Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
• CIS Controls v8 — Control 12 — Network Infrastructure Management

How to move it toward Implemented

• Inventory the radios: run nmcli device status, rfkill list, and lspci | grep -i network (plus bluetoothctl list for Bluetooth), and save the output as a dated file.
• If the server is wired-only (most lab servers are), disable the radios: nmcli radio wifi off, then rfkill block wifi bluetooth and systemctl disable --now wpa_supplicant bluetooth. This closes AC-18(3).
• Make it stick across reboots by blacklisting the driver — add blacklist <module> to /etc/modprobe.d/no-wireless.conf, then run update-initramfs -u (or dracut -f) — so a reboot cannot bring the radio back.
• If wireless is required instead, write a one-page wireless standard: the configuration and connection requirements per type, who authorizes it, and a rule that only WPA2/WPA3-Enterprise is allowed (this closes AC-18(1)).
• Attach that inventory (and the disable-command output or the wireless standard) as hardening evidence on the asset, naming AC-18 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.