Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.1.15 and CMMC Level 2 assessment objective AC.L2-3.1.15[a].
What This Objective Means
This objective ensures your team can identify the encryption technologies used to protect wireless networks and confirm they meet required security standards.
You must be able to identify the encryption protocols in use, whether encryption is FIPS-validated, how encryption keys are managed, and whether encryption is applied across all wireless access points.
Why Wireless Encryption Identification Matters
Weak or unverified encryption can leave wireless traffic vulnerable to eavesdropping, session hijacking, and credential theft.
Documenting what encryption is actually used helps validate that wireless connections are protected by design, not assumed to be secure.
How to Implement AC 3.1.15a
Review wireless access point and wireless controller configurations to identify the encryption settings in use across all wireless networks, including guest networks and any remote-worker wireless scenarios that connect to organizational systems.
Confirm the configured protocols and ciphers (for example WPA2-Enterprise or WPA3, and AES rather than legacy options) and document whether the cryptographic modules are FIPS-validated where required by your technical standards.
Ensure the encryption configuration and key management approach align with your access control policy and your broader CMMC access control requirements.
Wireless Encryption Checklist
| Item | What to Verify |
|---|---|
| Encryption protocol | Identify what is configured (for example WPA2-Enterprise or WPA3) and avoid deprecated protocols. |
| Cipher selection | Confirm strong ciphers are used (for example AES) and legacy options are not enabled. |
| FIPS validation status | Document whether the encryption modules used are FIPS-validated where required. |
| Key management | Identify how keys are created, stored, rotated, and protected (including who can administer changes). |
| Coverage across access points | Confirm encryption settings are applied consistently across all wireless access points and locations. |
| Non-production networks | Verify guest or auxiliary wireless networks are still configured deliberately and do not introduce exposure to protected systems. |
Evidence Assessors Commonly Expect
Assessors typically expect documentation that lists the wireless encryption protocols used, screenshots or exported configurations from wireless controllers or access points, and confirmation that encryption is enabled consistently across all wireless access points.
They also commonly expect references to wireless encryption methods in the System Security Plan (SSP) and supporting artifacts that map to a NIST 800-171 controls overview.
Common Gaps to Avoid
Common gaps include not documenting the encryption method, using outdated protocols (such as WEP or WPA), and having inconsistent configurations across sites or devices.
FAQ
What encryption details must be identified for AC.L2-3.1.15[a]?
Identify the wireless encryption protocol in use, whether it is FIPS-validated where required, how keys are managed, and whether encryption is consistent across all access points.
Why does FIPS validation matter for wireless encryption?
FIPS validation helps confirm the cryptographic module meets required standards when your environment or policies require FIPS-validated encryption.
What evidence supports compliance with AC.L2-3.1.15[a]?
Evidence commonly includes a documented list of protocols, screenshots or exports of wireless configuration settings, and SSP references showing how wireless encryption is implemented.