| AC-18 (1) Authentication And Encryption | MODERATE | The information system protects wireless access to the system using authentication of Selection (one or more): users; devices and encryption. | AC-18 (2) Monitoring Unauthorized Connections | | Withdrawn: Incorporated into SI-4. | AC-18 (3) Disable Wireless Networking | | The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment. | AC-18 (4) Restrict Configurations By Users | HIGH | Organizational authorizations to allow selected users to configure wireless networking capability are enforced in part, by the access enforcement mechanisms employed within organizational information systems. The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities. | AC-18 (5) Antennas / Transmission Power Levels | HIGH | Actions that may be taken by organizations to limit unauthorized use of wireless communications outside of organization-controlled boundaries include, for example: (i) reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be used by adversaries outside of the physical perimeters of organizations; (ii) employing measures such as TEMPEST to control wireless emanations; and (iii) using directional/beam forming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational information systems as well as other systems that may be operating in the area. The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries. | 