- Use WPA2/WPA3-Enterprise (802.1X) for the networks that matter, so joining requires an individual credential or certificate that can be revoked.
- Where a pre-shared key network must survive, rotate the key on personnel changes and keep that network segregated from CUI systems.
3.1.17OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.1.17 — Wireless access protection
3.1 Access Control · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Protect wireless access using authentication and encryption.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Wireless that can reach systems holding CUI authenticates its users and encrypts its traffic — no open networks, and ideally no single shared password taped to the breakroom wall. Enterprise authentication ties wireless access to individual identities instead of one secret everyone knows.
Across revisions
Withdrawn as a standalone slot in Rev. 3 (03.01.17); authentication and encryption of wireless access are carried inside the Wireless Access requirement, 03.01.16.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Wireless controller configuration showing authentication mode and encryption per network
- Records of key rotation or certificate issuance practice
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |