What AC.L2-3.1.16 wireless access authorization requires in practice
If any Wi-Fi network, access point or wireless client touches a system that handles CUI, AC.L2-3.1.16 applies, and the organization must show two things. First, it must identify every wireless access point in the environment that is connected to, or could reach, the CUI boundary. Second, it must authorize wireless access before any connection is allowed, meaning a documented decision exists for each wireless network and each device type permitted to join it. A quick scan of the office is not enough. Assessors expect the list of access points to match what is actually installed, and they expect the authorization to exist before the connection, not after someone notices it. Start by asking the IT team whether any wireless network, including guest or printer networks, can reach in-scope segments, and record the answer in the system security plan.
The risk this requirement targets is the rogue or unmanaged access point: a consumer router plugged in under a desk, a contractor's hotspot, or a mis-scoped guest network that bridges to the corporate LAN. Any of these can give an attacker a path around the wired boundary controls that the rest of the environment depends on. Because the requirement is worth 5 points under the CMMC Scoring Methodology, leaving it unmet costs more than a single point, and under 32 CFR 170.21 it cannot be carried on a plan of action and milestones. The practical consequence is that the organization must either demonstrate MET status for this requirement or rebuild its wireless posture before assessment, so the identification and authorization work should begin early.
Confirm two points with your assessor's guidance and your own environment before you scope the work. The first is whether any wireless capability exists at all in the system boundary, including devices that expose Wi-Fi or Bluetooth. The second is who owns the authorization decision and where that decision is recorded. The NIST SP 800-171A objectives tie authorization to the configuration management plan and to audit records, so an authorization that lives only in an administrator's memory will not satisfy the requirement. Plan for a written authorization for each wireless network, a periodic check that the access point inventory matches reality, and a process that stops unauthorized access points before they connect.
Which wireless networks and devices fall under AC.L2-3.1.16
Scoping AC.L2-3.1.16 starts with a simple question: which wireless access points and endpoints can reach systems that process, store or transmit CUI? The cards below cover the decisions assessors expect you to document, from access points inside the boundary to Wi-Fi added after an assessment.
Access points inside the CUI boundary
Any wireless access point that connects to a network segment carrying CUI is in scope for AC.L2-3.1.16. Include access points that are wired into the boundary, controller-managed units and any point that bridges a wireless network to a wired segment. Confirm the answer against your network diagram and asset inventory, not against memory. Record each access point with its location, owner and the segment it joins, because assessors will ask you to show the identifying step before the authorization step.
Guest and corporate networks on shared hardware
A guest SSID broadcast from the same controller or access points as the corporate SSID is still part of the same wireless infrastructure. Decide whether the shared hardware can reach CUI systems, then document the separation (VLANs, firewall rules, client isolation). If the guest network can route to the CUI segment, treat the whole wireless path as in scope. Ask your network team to confirm this in writing, since shared configuration is a common source of surprises.
Wireless-capable endpoints in scope
Laptops, tablets, printers, scanners, handheld test equipment and some industrial devices can join wireless networks even when they are wired most of the time. Each endpoint that can connect wirelessly to a CUI-bearing network needs to be identified and authorized before it connects. Check Wi-Fi radios that are enabled by default, dual-homed devices and personal devices that can join a corporate network. Inventory tools can help surface these, but confirm each device's wireless capability directly.
Third-party and managed wireless
Wireless service provided by a landlord, a managed service provider, a shared building network or a cloud-managed access point service still falls under your responsibility when it carries CUI. Your contracts and service descriptions should state who authorizes access points, who keeps configuration records and who produces audit evidence. Ask providers for documentation you can show an assessor. If the provider cannot supply it, the gap belongs in your scoping analysis.
No wireless today, and what changes later
A system with no wireless access points or wireless-capable endpoints can be marked N/A for AC.L2-3.1.16 and AC.L2-3.1.17. That status is only valid while the system stays that way. The DoW CMMC FAQ treats adding Wi-Fi to a system that achieved its CMMC Status without it as a change that requires reassessment, because both requirements become applicable. Put a Wi-Fi change check into your change control process so the N/A status is revisited before any radio is turned on.
Records that prove the scope
Keep a dated scope statement for wireless: the access points and endpoints you considered, the ones you excluded and the reason for each exclusion. Assessors test whether the scope matches the actual environment, so the statement needs to match your configuration records and asset inventory. Review it when the network changes, when a new site opens or when a contract adds a system that handles CUI.
How an assessor tests wireless access authorization
Before any live testing, the assessor reviews the documents and records that define how wireless access is governed. NIST SP 800-171A lists the assessment objects for this requirement, and the assessor uses them to confirm that the organization has written rules, approved configurations and a traceable record of every authorization. The review is not a formality. If the documents are missing, draft or inconsistent with the live network, the assessor cannot mark the objectives satisfied, and the evidence must be in final form to count.
- Wireless access procedures and restrictions: Written procedures that state who may request wireless access, which device types are allowed and which are prohibited.
- Configuration management plan: Entries showing how access points and client devices are baselined, changed and approved, including the wireless settings they must carry.
- Wireless access authorizations: Signed or system-recorded approvals for each access point and for the device types permitted to connect.
- Configuration settings and audit records: Exports of access point settings and logs showing when authorizations were granted, changed or revoked.
- Inventory of access points: A list that matches the authorizations, so the assessor can confirm every access point is identified.
Confirm with your assessor, before the assessment, which artifact formats they accept and whether draft procedures are acceptable for any portion of the review.
The live test checks whether the wireless access management capability works as the documents describe. The assessor selects a sample of the environment and attempts to see whether unauthorized access points or devices can join the network. They also check whether authorized access points match the recorded configuration. The aim is to confirm that the authorization step happens in practice, not only on paper.
- Identify access points: The assessor compares what the wireless scanner or controller reports against the authorized inventory and looks for unknown or rogue access points.
- Attempt an unauthorized connection: The assessor may try to join with a device that has no authorization and observes whether the network blocks it.
- Verify an authorized connection: The assessor confirms that an approved device can connect under the stated rules and that the connection is recorded.
- Check configuration against the baseline: Live settings on sampled access points are compared with the configuration management plan.
- Review alerts and audit trails: The assessor looks for records of rejected or unknown connection attempts and how staff responded.
Before the assessment, run these same checks yourself and keep the results, so the live demonstration does not reveal gaps for the first time.
Most findings on this requirement come from a mismatch between the documents and the network. The assessor may find a well-written procedure that the live environment does not follow, or a configuration that changed after the last authorization was recorded. Because a NOT MET result on AC.L2-3.1.16 cannot be placed on a POA&M, these mismatches are the main risk to reaching a Conditional or Final status.
- Undocumented access points: A device added during a site expansion or a temporary project that never received an authorization record.
- Stale authorizations: Approvals that reference access points or device types no longer in use.
- Configuration drift: Live settings that differ from the baseline without a change record.
- Draft-only procedures: Policies still in review, which do not count as final evidence.
- Gaps in audit records: Logs that do not show when authorizations were granted or when unknown devices were refused.
If your environment changes often, confirm with your assessor how they treat changes made between the assessment and the status date.
Preparation means arranging the evidence so the assessor can move from documents to live tests without delay. Organizations that succeed usually reconcile their wireless inventory, authorizations and configuration exports before the assessment window, then run a short internal rehearsal. Open-source tools can help generate inventory and configuration records, but the organization still owns the decision to authorize each access point, and the assessor still makes the determination.
- Reconcile three sources: Match the access point inventory, the authorization records and the live configuration exports.
- Assign an owner for each record: Name the person who approves and maintains each authorization.
- Rehearse the live checks: Run an internal test that mirrors the assessor's attempts to find and join unauthorized devices.
- Keep final versions: Store signed or approved versions of procedures and plans with clear dates.
- Plan for later changes: Adding Wi-Fi to a system that already holds a CMMC status can require reassessment, so review this with your assessor first.
Ask your assessor to confirm exactly which records and live demonstrations they will request, so the rehearsal covers the same ground.
Steps to authorize wireless access before it is allowed
This sequence moves an organization from an unknown set of wireless devices to a recorded, approved and monitored wireless environment, so that every access point in scope can show an authorization before any client connects. Each step produces an artifact an assessor can examine against the two assessment objectives for AC.L2-3.1.16.
Inventory every access point and wireless controller
Start by finding every wireless access point, wireless controller, bridge and hotspot-capable device in the environment, including units installed by facilities staff, vendors or individual departments. Use a network scan, switch and controller records, and walkthroughs of each site, then compare the results against the asset inventory so nothing is missed. The step is done when the inventory lists each device with its location, owner, make, model, firmware version and whether it sits inside the CUI system boundary. Any device found that cannot be tied to an owner is treated as unauthorized until it is resolved.
Define allowed device types and configuration baselines
Write down which wireless device types the organization permits, which client device types may connect, and the configuration each approved access point must meet. The baseline should cover the authentication method, encryption settings, SSID naming, management access restrictions, logging and firmware currency. Tie these settings to the configuration management plan so that the baseline is a controlled document, not an informal preference. The output is an approved baseline with a named owner and a revision history that assessors can read alongside the wireless configuration files.
Document the wireless authorization workflow
Define how a new access point or wireless change is requested, reviewed, approved, installed and recorded. The workflow should name who may request a change, who checks it against the baseline, who approves it, and who verifies the installed configuration matches what was approved. Include the rule that no access point goes live until its authorization record is complete. The output is a written procedure with defined roles, which assessors use to test whether the organization actually follows the process it describes.
Configure and approve each access point
Apply the approved baseline to each inventoried access point and wireless controller, then confirm the running settings match the baseline rather than assuming the template was applied. Record the verification result for each device, including any deviation and the approval for it. Devices that cannot meet the baseline are either corrected or removed from service. The output is a per-device configuration record showing the approved settings, the verification date and the approver, which is the evidence assessors examine for the configuration settings objective.
Record wireless access authorizations
Create a formal authorization record for each access point and for the client device types allowed to connect to it. Each record should identify the device, the approved purpose, the authorizing official, the baseline version applied and the review date. Keep the authorizations current as devices are replaced, moved or reconfigured. The output is a maintained authorization register that can be produced on request, since assessors check for authorizations issued before connections were allowed rather than assembled after the fact.
Monitor for unauthorized access points
Run periodic and event-driven checks that compare what the environment actually broadcasts and connects to against the authorization register. Wireless scanning, controller reports and network inventory can all reveal rogue access points or unexpected SSIDs. Route each finding into the incident or change process, and document the disposition. The output is a monitoring record showing scan dates, results and the action taken for every unauthorized device, which also supports the audit records objective in the assessment guide.
Reassess when wireless is added later
Treat any new wireless access point or wireless capability on a system as a change that brings AC.L2-3.1.16 and AC.L2-3.1.17 into scope. If a system achieved its CMMC status without wireless and Wi-Fi is later added, the DoW CMMC FAQ (July 2026) describes that change as requiring reassessment, because both requirements had been assessed as N/A and now apply. Confirm the reassessment obligation with your contracting officer and assessor before the change goes live. The output is a change record that links the new wireless deployment to the authorization workflow and to the reassessment decision.
Evidence that satisfies wireless access authorization
Assessors test AC.L2-3.1.16 by reading documents and then checking that the live system matches them. The cards below cover each artifact type, what it must show, and how to keep it current so the evidence still holds when the assessment happens.
Wireless access procedures and restrictions
This is the written rule set that says who may request a wireless connection, which device types are allowed, which wireless configurations are prohibited, and who approves exceptions. Assessors read it first, because the other artifacts should trace back to it. Check that it names the approving role, states how unauthorized access points are handled, and reflects how the network actually runs today. A procedure that describes a wireless design the network no longer uses is one of the most common reasons evidence fails to tie together.
Wireless access point inventory
The inventory lists every wireless access point in scope, with its identifier, location, model, the network segment it joins, and the owner who authorized it. Assessors compare it against a sample of what they find on site or in the configuration, so an access point that appears in the network but not in the list is a finding. Reconcile the inventory against controller records or network discovery output before the assessment, and record the date of that reconciliation.
Signed wireless access authorizations
Each authorization records the access point or device type, the business reason, the approving official, the approval date and any conditions attached, such as limits on which networks it may reach. Assessors look for a signature or an approval record in a system of record, not a verbal agreement. Confirm that every access point in the inventory has a matching authorization, and that no authorization has lapsed without a review.
Configuration baselines and management plan
The configuration baseline sets the approved settings for each wireless device type, and the configuration management plan explains how changes to those settings are requested, reviewed and recorded. Assessors compare the baseline with the running configuration. Confirm the baseline names the approved wireless security standard and version, and that the change process produces a record for each change.
Configuration exports and audit records
Exports of controller and access point settings, taken at a known date, show what the system actually enforces. Audit records show who changed settings, when, and whether the change was approved. Take exports from the device or controller itself, retain them with a timestamp, and confirm that logs of configuration changes are being collected centrally rather than only on the device that changed.
Final form, current records and Wi-Fi changes
Assessors accept a requirement as MET only when evidence is in final form, not drafts, so an unsigned procedure or a pending authorization does not count. Keep records current by tying each new access point to a change request and an updated inventory entry before it goes live. Adding Wi-Fi to a system that already holds a CMMC status triggers reassessment, so treat any new wireless connection as a reassessment trigger and confirm the current status with your assessment sponsor.
What meeting AC.L2-3.1.16 costs in money and effort
This table breaks down the cost and effort components of authorizing wireless access under AC.L2-3.1.16, showing who is paid for each, whether it is one-time or recurring, and what moves it up or down. No figures are given because none were supplied, so use the drivers to build the questions you put to a quote. The main takeaway is that most of the recurring cost comes from keeping the wireless inventory and authorizations current, not from the hardware itself.
| Cost component | One-time or recurring | Who is paid | What drives it up or down |
|---|---|---|---|
| Wireless controller and access point hardware or licenses | One-time purchase, with recurring license or support fees | Hardware vendor or reseller, and any managed controller service | Number of sites and access points, whether you already own compatible controllers, and whether licenses are per device or per controller |
| Engineering time to build wireless baselines | One-time | Internal IT staff or an implementation partner under a written scope | Number of SSIDs, device types in use, and how many configuration settings must be documented and matched to the configuration management plan |
| Authorization and wireless inventory upkeep | Recurring | Internal network or IT operations staff | Frequency of access point changes, guest or contractor Wi-Fi, and whether the asset inventory updates automatically |
| Change control for new wireless access | Recurring | Internal change board and network staff | Number of requests per quarter, and whether approval steps are tied to a ticketing system that leaves an audit trail |
| External review or testing of wireless configuration | Periodic, usually one-time per cycle | Independent tester or consultant under a fixed-scope agreement | Size of the wireless footprint, depth of testing requested, and whether the test covers rogue access point detection |
| Assessor sampling time | Recurring per assessment | Certified third-party assessor (C3PAO) under its own agreement | How many access points and authorization records the assessor samples, and how complete your evidence is before the visit |
| Re-assessment after Wi-Fi is added | Triggered, one-time per change | Assessor and internal staff | Whether Wi-Fi was previously marked N/A for the system, since adding it makes AC.L2-3.1.16 and AC.L2-3.1.17 applicable |
Who owns wireless authorization, who prepares evidence, and who assesses it
Leadership owns the decision to allow wireless access to any system that processes, stores or transmits CUI. That decision is an authorization, and it cannot be handed to a consultant, a partner or a managed service provider. Leaders set the risk position for the environment, name who may approve connections and accept any residual risk in writing. An assessor will look for a signed decision trail that starts at this level, because the requirement is about the organization controlling its own wireless access.
- Risk position: Decide whether Wi-Fi is permitted inside the CUI boundary at all, and record the reason in the system security plan.
- Authorizing official: Name the person who signs wireless authorizations and give that person the authority to refuse a request.
- Scope decisions: Decide whether guest, contractor or visitor networks sit inside or outside the assessment boundary. This choice drives the size of the inventory, the configuration work and the evidence set.
- Policy approval: Approve the wireless access policy and the management guidelines for device types and configuration, with an owner and a review date.
Confirm that the signed policy, the decision record and the current system security plan all describe the same wireless environment.
The internal security and IT team runs the authorization process day to day. Its staff maintain the list of access points, record each approval before a device connects, and check the network for equipment that was never approved. These records are usually the first items an assessor samples, so they must be current and complete. A gap here often shows up as an access point that exists on the floor but not in any record, which is hard to explain once an assessment is underway.
- Access point inventory: Keep a current list of every access point and controller with model, location, network purpose and owner.
- Authorization records: Record each approval before the connection goes live, with the date, approver and the configuration baseline it was checked against.
- Rogue detection: Run periodic wireless surveys and compare the results to the inventory, then investigate every unknown device.
- Change triggers: Route any new Wi-Fi addition through reassessment review before it is enabled, since adding wireless to a system that previously had none changes its status.
Confirm that the team can produce the inventory entry and the signed authorization for any single access point within a short sampling window, in final form rather than drafts.
An implementation partner can prepare the work that the contractor then reviews and adopts. Typical outsourced items include wireless configuration baselines, inventory and log configuration, evidence packaging and internal test runs against the assessment objectives in NIST SP 800-171A. DeployOpen works this way: it plans, builds and documents systems inside the client's own environment under a fixed scope agreed in writing. The partner does not decide what is authorized, does not sign the authorization and does not issue findings or certificates.
- Configuration preparation: Build wireless baselines for the approved device types, aligned to the contractor's own guidelines and reviewed by the contractor before use.
- Inventory and logging: Connect wireless controllers and endpoint inventory to self-hosted records the team can export, such as those produced by open-source asset and inventory tools.
- Evidence packaging: Assemble procedures, configuration settings, audit records and authorization files into one organized evidence set.
- Internal testing: Run pre-assessment checks against each objective so the contractor can close gaps before an external assessor arrives.
Ask for a written scope that lists the networks, devices and evidence items covered, the named sign-off person for each deliverable and what happens when a new access point is added after delivery.
For Level 2 certification, assessments are performed by a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. The assessor tests each assessment objective against evidence and records each requirement as MET or NOT MET. Independence matters here: the assessor must not be placed in a position where its own design or implementation work is the thing it judges. Organizations should confirm the current timing for when certification applies, because the Department of War suspended the Phase II milestones in July 2026 and announced a review, so budgets should follow the latest official update.
- Objective testing: The assessor checks each objective in NIST SP 800-171A against evidence in final form and may select access points for direct testing.
- Outcome ownership: Only the assessor issues the MET or NOT MET result, and the contractor cannot record that outcome for itself.
- Independence line: An assessor generally cannot judge a baseline or evidence set that its own affiliated team wrote, so the contractor should review conflicts before engagement.
- Live verification: Expect interviews with the authorizing official and the IT staff, plus configuration checks on live equipment.
Before engaging an assessor, ask how it manages prior consulting work for the same organization and get that conflict review in writing.
Common gaps that fail wireless access authorization
Wireless access authorization fails less often on the policy than on the day-to-day record: an access point nobody approved, a change nobody reassessed, or an inventory that no longer matches the network. Each gap below can make a requirement that is worth 5 points NOT MET, and none can be moved to a POA&M, so the closing action for each one needs to be in place before an assessor arrives.
Rogue access points found during scans
A rogue access point is a wireless device connected to the network without an authorization record, often a personal router plugged in by staff or a vendor device left on a conference room switch. Assessors who scan the environment for wireless signals and compare them with approved devices will flag any unmatched radio. Run a periodic wireless survey of every CUI location and reconcile each detected access point against the authorization list. Document any unmatched device as a finding with a removal record, and keep the scan output as evidence.
Wi-Fi added without reassessment
When a system was assessed with no wireless access, AC.L2-3.1.16 and AC.L2-3.1.17 were scored as N/A. Adding Wi-Fi later makes both requirements applicable, and the DoW CMMC FAQ treats that change as one that requires reassessment. Put a wireless check into the change control process so that no access point is installed in a CUI boundary until the system security plan, the authorization record and the configuration baseline have been updated.
Authorizations recorded verbally
A manager who says in a meeting that a new access point is fine has not produced an authorization. Assessors look for the wireless access authorization itself, with the device, its owner, the approval date and the approver written down. Replace verbal approvals with a ticket or form that the approver signs, and link each access point to that record in the asset inventory.
Guest networks sharing CUI infrastructure
A guest wireless network that uses the same switches, controllers or firewall segment as CUI systems extends the wireless boundary into the assessed environment. Even if the guest traffic is encrypted, the shared infrastructure must be authorized and documented. Separate guest SSIDs onto their own VLANs or physically distinct equipment, and confirm that the boundary rules block traffic from guest clients to CUI segments. Record the separation in the network diagram.
Inventories that do not match installed devices
An inventory that lists three access points while the building has five is an assessment failure, regardless of whether the extra devices are secure. Automated discovery closes this gap: an inventory tool that collects hardware and network interfaces from endpoints, and an asset register that records network equipment, can show which devices are actually present. Compare the two sources on a fixed schedule and treat every difference as a change to authorize or remove.
What happens when Wi-Fi is added after a CMMC status
If you add Wi-Fi to a system that already holds a CMMC status without it, treat that change as one that requires reassessment. The DoW CMMC FAQ (July 2026) takes this position because AC.L2-3.1.16 and AC.L2-3.1.17 were assessed as N/A for the system. Once wireless is present, both requirements become applicable, and the assessed status no longer describes the system you are running. The practical decision is therefore not whether to reassess but when, and with whom. Before the access point goes live, confirm with your sponsor (the contracting office or prime contractor that relies on your status) and with your assessor what reassessment is required, what evidence they expect, and whether the change affects the system security plan and your SPRS posting.
Plan the wireless build so the evidence exists before the first connection. For AC.L2-3.1.16, that means a documented wireless access procedure, a list of approved access points and device types, a written authorization for each wireless connection, and configuration records showing how the access points are managed. Your configuration management plan and audit records should show who approved the change and when. Wireless is also where AC.L2-3.1.17 applies, so the authentication method, the encryption configuration and the FIPS-validated cryptography must be ready at the same time. Assessors will test these against the live environment, not against a design document.
The Phase II suspension announced on 13 July 2026 changes the timing of enforcement, not the requirement. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, and the eCFR still lists the original phase schedule. If your contracts or sponsor require Level 2 status, the wireless change still needs to be handled as a controlled change to a system that holds that status. Ask your sponsor in writing how they want the change reported, and record that answer alongside your change control ticket.
Questions buyers ask about wireless access authorization
What does wireless access authorization cost to implement?
Most of the cost is labor, not licenses. The organization pays its own staff to inventory wireless access points, write the authorization procedure, and configure the access points and controllers so only approved devices connect. An outside implementation partner may be paid under a fixed-scope written agreement to prepare those settings and evidence. The main cost drivers are the number of sites, the number of access points, whether wireless is managed centrally or per location, and how much of the configuration already exists. Ask any quote to itemize discovery, configuration, evidence preparation, and a one-time versus recurring split for monitoring and reviews. The requirement is worth 5 points under the CMMC Scoring Methodology in 32 CFR 170.24, and because it is worth more than 1 point, 32 CFR 170.21(a)(2) does not allow it on a POA&M, so it must be MET.
How long does preparation for AC.L2-3.1.16 take?
The duration depends on how many wireless networks exist, how many sites they cover, and whether an authorization process already exists. Organizations with a single, well-documented network usually need far less time than those with many unmanaged access points added over years. No reliable duration applies to every environment, so ask a prospective partner for a timeline tied to a written scope, and confirm which steps depend on your own change approvals. Keep in mind that the requirement must be fully MET at assessment, so evidence needs to be final, not drafts, under 32 CFR 170.16 and 170.17. Check the current status of CMMC Phase II with your contracting officer before you set deadlines, since the Department of War suspended it in July 2026.
Can our team handle wireless access authorization in-house?
Often yes, if your staff can read the wireless configuration and maintain the inventory. The work is mostly documentation and configuration discipline: a list of access points and their owners, a written rule for which device types and configurations may join, and records showing each authorization. Teams with a network engineer and a documented change process usually handle the core steps internally. Outside help is most useful for scoping, for configuring controllers and identity-based wireless authentication, and for building evidence that will hold up under review. Whichever route you pick, the organization owns the control. An independent assessor, not your implementation partner, judges whether it is met.
What does our staff need to provide for this requirement?
Your staff must supply the facts only they know. Plan for network engineering time to export access point and controller configurations, a security owner who approves the authorization procedure, and an IT administrator who maintains device records. Staff also need to follow the process, because an unapproved access point connected by a facilities team or an employee can break the control. Ask for named owners for each task, a review cadence agreed in writing, and training for anyone who can add wireless hardware. The assessment objectives in NIST SP 800-171A require evidence of procedures, authorizations, configuration settings, and audit records, so each of those needs a responsible person.
What happens if we add Wi-Fi to a system after we achieved CMMC status?
Adding Wi-Fi to a system that achieved its CMMC status without it is a change that requires reassessment. The DoW CMMC FAQ (July 2026) explains that AC.L2-3.1.16 and AC.L2-3.1.17 were assessed as N/A in that case and become applicable once wireless is present. Before deploying any access point, document the change, authorize the wireless configuration, and confirm that the authorization and protection controls are in place. Plan for the reassessment itself, because the new requirements must be MET. Talk to your assessor or sponsor early so the change does not surprise you during a renewal or contract review.
What evidence shows that wireless access was authorized before connection?
Assessors look for a written procedure, an inventory of wireless access points, the authorizations themselves, and records that match what is actually on the network. Under NIST SP 800-171A, the potential objects include wireless access procedures and restrictions, the configuration management plan, wireless access authorizations, configuration settings, and audit records. Expect them to test the live system too, so they may check that an unlisted device cannot connect. Keep the evidence final and dated, and tie each access point to an authorization record and an owner.
How do open-source tools help with wireless access authorization?
Open-source tools can support the inventory and monitoring side of the control, but they do not authorize access by themselves. GLPI's Assets module can record network equipment and related details, entered manually or pushed by the GLPI Agent through native inventory built into GLPI since version 10. Wazuh's Syscollector module collects network interfaces, open ports, and installed software from each endpoint for inventory views and reports. Confirm with each vendor which wireless details each tool can capture in your environment before relying on it. OPNsense rules and aliases can help restrict which networks reach your internal resources, though you should verify that wireless segments are handled as you intend.
How DeployOpen prepares wireless access evidence for CMMC
DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so the wireless access inventory, authorization records and configuration evidence for AC.L2-3.1.16 can be produced from systems the organization controls. We prepare the systems and evidence; the organization owns its controls, and only an independent C3PAO or other authorized assessor can assess and certify them.
How we scope
- We agree the written scope with you, listing every wireless access point, controller and segment that touches the assessment boundary.
- We confirm which Wi-Fi networks, if any, are currently in use and whether they were assessed as N/A for AC.L2-3.1.16 and AC.L2-3.1.17.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts; ongoing support is available as a retainer.
How we build
- We set up an asset inventory in GLPI that records wireless access points and network equipment, with entries maintained manually or pushed by the GLPI Agent.
- We configure OPNsense rules and aliases so that only authorized wireless segments can reach CUI systems, with rule-match logging enabled for review.
- We align wireless configuration records with your configuration management plan so authorization decisions and settings can be traced to one another.
How we hand over
- We document the wireless access procedure, the authorization workflow and the approval records that show each access point was authorized before connection.
- We export inventory views, configuration settings and audit records as dated evidence, and flag any gaps that would leave the requirement NOT MET.
- We hand over the system security plan inputs and a change trigger list so new Wi-Fi is reassessed before it is connected.
How we support
- We review the wireless inventory with your team on a schedule you agree, so unauthorized access points are caught before an assessment.
- We support reassessment work when Wi-Fi is added to a system that previously achieved its CMMC status without it.
- Ongoing support, upgrades and continuous testing are available as retainers, and we confirm the current assessment requirements with your sponsor or assessor before each cycle.
