03.01.16 — (a) Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. (b) Authorize each type of wireless access to the system prior to establishing such connections. (c) Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment. (d) Protect wireless access to the system using authentication and encryption.

What this control requires

(a) Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. (b) Authorize each type of wireless access to the system prior to establishing such connections. (c) Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment. (d) Protect wireless access to the system using authentication and encryption.

Source: NIST SP 800-171 R3 §03.01.16 (official control text).

Why this matters

Wireless networks create invisible attack surfaces that extend beyond physical building boundaries. Unlike wired connections, wireless signals can be intercepted from parking lots, adjacent buildings, or public areas without any physical intrusion. Adversaries routinely exploit weak wireless configurations to capture credentials, inject malicious traffic, or establish persistent backdoor access. This control ensures that every wireless connection—whether corporate Wi-Fi, guest networks, or Bluetooth peripherals—operates under documented restrictions, requires explicit authorization before deployment, and employs strong authentication and encryption. By disabling unused wireless capabilities on devices before deployment, organizations eliminate opportunistic attack vectors that adversaries scan for constantly.

What evidence assessors expect

Assessors typically look for: PDF, configuration export, screenshot, CSV export. FORCE coaches you through the exact implementation steps and captures each artifact in-platform.

Related controls