Wireless Access Authorization
Authorize wireless access prior to allowing such connections.
What gets scored, the objectives
AC.L2-3.1.16 is met only when every one of these 2 objectives, from NIST SP 800-171A, is satisfied. A single missed objective makes the whole requirement not met.
- a.wireless access points are identified
- b.wireless access is authorized prior to allowing such connections
How this is assessed
NIST SP 800-171A defines three assessment methods. For AC.L2-3.1.16, whoever assesses it, including your own team in a self assessment, uses these:
Access control policy; configuration management plan; procedures addressing wireless access implementation and usage (including restrictions); system security plan; system design documentation; system configuration settings and associated documentation; wireless access authorizations; system audit logs and records; other relevant documents or records
Personnel with responsibilities for managing wireless access connections; personnel with information security responsibilities
Wireless access management capability for the system
What it means, in context
Establishing usage restrictions and configuration/connection requirements for wireless access to the system provides criteria for organizations to support wireless access authorization decisions. Such restrictions and requirements reduce the susceptibility to unauthorized access to the system through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication.
Guidelines from management form the basis for the requirements that must be met prior to authorizing a wireless connection. These guidelines may include the following: • types of devices, such as corporate or privately owned equipment; • configuration requirements of the devices; and • authorization requirements before granting such connections. AC.L2-3.1.16, AC.L2-3.1.17, and AC.L2-3.1.18 are complementary requirements in that they all establish control for the connection of mobile devices and wireless devices through the use of authentication, authorization, and encryption mechanisms. Example Your company is implementing a wireless network at its headquarters. CUI may be transmitted on this network. You work with management to draft a policy about the use of the wireless network. The policy states that only company-approved devices that contain verified security configuration settings are allowed to connect. The policy also includes usage restrictions that must be followed for anyone who wants to use the wireless network. Authorization is required before devices are allowed to connect to the wireless network [b].
What passing evidence looks like
The authorized wireless list (each SSID, who approved it) and proof rogue or personal hotspots are not part of the CUI network.
Common ways contractors fail AC.L2-3.1.16
- !The guest Wi-Fi must be documented as out of the CUI path or properly separated, an undocumented guest network on the same LAN fails the boundary story too.
The step by step walkthrough for Microsoft 365 GCC High, Google Workspace, and on premises setups, plus the exact evidence to capture, lives inside the CMMC Level 2 plan.
Prove AC.L2-3.1.16, and the other 109
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
AC.L2-3.1.16 questions, answered
How many points is CMMC requirement AC.L2-3.1.16 worth?+
AC.L2-3.1.16 is worth 5 points in the CMMC Level 2 score under 32 CFR 170.24. If it is not met, you lose 5 from your total of 110.
Can AC.L2-3.1.16 be placed on a POA&M?+
No. AC.L2-3.1.16 must be fully met before you can file. It cannot be deferred to a POA&M, so it is a gate on your assessment.
What family does AC.L2-3.1.16 belong to?+
AC.L2-3.1.16 is in the Access Control (AC) family, one of the 14 families of NIST SP 800-171 that make up CMMC Level 2.
- NIST SP 800-171 Rev. 2 3.1.16