AC-18 has two parts. Set configuration requirements, connection requirements and implementation guidance for each type of wireless access. Then authorize each type before it connects.
800-53 binds federal systems and, through contract, some suppliers. For an office or a lab it works as a reference for what to write down.
What it means in practice
The guidance names technologies such as 802.11x and Bluetooth, and notes that wireless networks use authentication protocols that protect the authenticator and provide mutual authentication. For most small companies the work comes down to an office network policy.
The enhancements are AC-18.1 Authentication and Encryption, AC-18.2 Monitoring Unauthorized Connections, AC-18.3 Disable Wireless Networking, AC-18.4 Restrict Configurations by Users and AC-18.5 Antennas and Transmission Power Levels.
Evidence to collect
- A wireless standard naming allowed networks and security settings.
- An approval record for each network type.
- Access point configuration showing the standard in effect.
Common gaps
- A guest network sharing a segment with internal systems.
- Shared passphrases that never change after staff leave.
How to implement it
Use enterprise authentication where you can, isolate guests, and keep the standard to a single page.
Quick check
What must happen before wireless access is allowed?
Each type of wireless access must be authorized before connections are permitted.
Sources
- NIST SP 800-53 Rev 5, AC-18: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-18
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
