All wireless systems (including associated peripheral devices, operating system, applications, network/PC connection methods, and services) must be approved by the Designated Approval Authority (DAA) prior to installation and use for processing DoD information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8283	WIR0005	SV-8778r17_rule	ECWN-1	High

Description
Unauthorized wireless systems expose DoD networks to attack. The DAA and appropriate commanders must be aware of all wireless systems used at the site. All wireless systems must be kept to a minimum needed for operations. DAAs should ensure a risk assessment for each system including associated services and peripherals is conducted before approving. Accept risks only when needed to meet mission requirements.

Description

Unauthorized wireless systems expose DoD networks to attack. The DAA and appropriate commanders must be aware of all wireless systems used at the site. All wireless systems must be kept to a minimum needed for operations. DAAs should ensure a risk assessment for each system including associated services and peripherals is conducted before approving. Accept risks only when needed to meet mission requirements.

STIG	Date
General Wireless Policy Security Technical Implementation Guide	2011-04-08

Details

Check Text ( C-3890r14_chk )
Work with the site POC to verify documentation. Performed with WIR0016 (equipment list). 1. Request copies of written DAA approval documentation. Any of the following documents meets this requirement as proof of compliance: - The DIACAP System Security Plan (SSP). The SSP must show the wireless system as part of the network diagram or list the system/equipment as being part of the network. -DAA approval letter or other document. The document must list the system or equipment and date its use is approved. The DAA approval letter or SSP may be a general statement of approval rather than list each device. 2. Verify DAA approval for type of device used such as wireless connection services, peripherals, and applications. Mark as a finding for any of the following reasons: Wireless systems, devices, services, or accessories are in use but DAA approval letter(s) do not exist. If, in the judgment of the reviewer, configuration differs significantly from that approved by the DAA approval letter. Note: The DAA approval for the wireless system does not need to be documented separately from other DAA approval documents for the site network, as long as the approval documents list the wireless system. For example, if a site network ATO lists the wireless system, the ATO meets the requirements of this check. For SME PED, the following applies: - An ATO or an IATO has been signed by the DAA prior to the connection of the unclassified Sensa server to the NIPRNet. - Classified Connection Approval Office (CCAO) approval has been obtained prior to the connection of the classified Sensa server to the SIPRNet. Note: The intent of this check is to ensure the DAA has approved the use of the wireless system being reviewed at the site. This approval can be documented in several ways. The most common is that the SSP for the site includes the wireless system and the DAA has signed the SSP. If the command uses an enterprise wide SSP and the SSP includes the wireless system being reviewed and the SSP applies to site being reviewed, than the requirement has been met.

Check Text ( C-3890r14_chk )

Work with the site POC to verify documentation. Performed with WIR0016 (equipment list).
1. Request copies of written DAA approval documentation. Any of the following documents meets this requirement as proof of compliance:
- The DIACAP System Security Plan (SSP). The SSP must show the wireless system as part of the network diagram or list the system/equipment as being part of the network.
-DAA approval letter or other document. The document must list the system or equipment and date its use is approved.
The DAA approval letter or SSP may be a general statement of approval rather than list each device.

2. Verify DAA approval for type of device used such as wireless connection services, peripherals, and applications.

Mark as a finding for any of the following reasons:
Wireless systems, devices, services, or accessories are in use but DAA approval letter(s) do not exist.
If, in the judgment of the reviewer, configuration differs significantly from that approved by the DAA approval letter.

Note: The DAA approval for the wireless system does not need to be documented separately from other DAA approval documents for the site network, as long as the approval documents list the wireless system. For example, if a site network ATO lists the wireless system, the ATO meets the requirements of this check.

For SME PED, the following applies:
- An ATO or an IATO has been signed by the DAA prior to the connection of the unclassified Sensa server to the NIPRNet.
- Classified Connection Approval Office (CCAO) approval has been obtained prior to the connection of the classified Sensa server to the SIPRNet.

Note: The intent of this check is to ensure the DAA has approved the use of the wireless system being reviewed at the site. This approval can be documented in several ways. The most common is that the SSP for the site includes the wireless system and the DAA has signed the SSP. If the command uses an enterprise wide SSP and the SSP includes the wireless system being reviewed and the SSP applies to site being reviewed, than the requirement has been met.

Fix Text (F-19194r1_fix)
Site obtains DAA approval for equipment (documented by memo or SSP)