Access Control 3.1.17 (3.1.17)

Do you have any wireless access points or WiFi networks in your facilities?

Are any wireless networks able to connect to systems that handle CUI?

Does this control require WPA3, or is WPA2 acceptable?

Both WPA2-Enterprise and WPA3-Enterprise are acceptable for CMMC Level 2, provided they use strong encryption (AES-CCMP for WPA2, AES-GCMP for WPA3). WPA3 is preferred for new deployments due to enhanced security features, but WPA2-Enterprise with proper configuration remains compliant. WPA2-Personal (PSK) is generally not recommended for enterprise environments but may be acceptable for very small organizations with documented key management processes.

Can we use a shared WiFi password for all employees, or does everyone need unique credentials?

Using a shared pre-shared key (PSK) for all employees is the weakest acceptable implementation and is only appropriate for very small organizations without enterprise authentication infrastructure. Best practice and assessor preference is WPA2-Enterprise or WPA3-Enterprise with 802.1X authentication, where each user has unique credentials. If using PSK, you must have a documented key management process including regular rotation and immediate key changes when employees leave.

Our guest WiFi is on the same network as our main network but behind a firewall - is this acceptable?

This depends on the firewall configuration and testing validation. The guest network must be completely isolated with no ability to reach systems containing CUI. Assessors will require network architecture documentation, firewall rules, and preferably penetration testing results confirming isolation. Best practice is a physically separate internet connection or dedicated VLAN with strict deny-all rules to internal networks. Simply being 'behind a firewall' without verified isolation is insufficient.

Do IoT devices like security cameras and printers need the same wireless security as computers?

Yes, all wireless devices that can access or interact with systems containing CUI must meet the authentication and encryption requirements. IoT devices often cannot use username/password authentication, so certificate-based authentication is commonly used. Each device should have unique credentials (not shared passwords), and IoT devices should be on a segmented network with restricted access to only necessary resources. Devices using default or shared credentials are a common assessment finding.

What happens if we have legacy equipment that cannot support WPA2-Enterprise or strong encryption?

Legacy equipment that cannot support modern wireless security standards creates a compliance gap. Options include: replacing the equipment, isolating it on a separate network with no access to CUI systems, or creating a POA&M with compensating controls and a timeline for replacement. Assessors will not accept legacy equipment with weak security if it can access CUI systems. Document all legacy equipment and its limitations during the assessment.

How often do we need to change our wireless password if we use WPA2-Personal?

If using pre-shared keys (PSK), you must have a documented rotation schedule - at minimum annually, but preferably quarterly. The key must also be changed immediately when any employee with access leaves the organization or if a device with the stored key is lost or stolen. The key management process, rotation schedule, and change history must be documented and available for assessment. Failure to rotate keys or change them when employees leave is a common finding.