AC.2.016 — Authorize Wireless Access Prior to Allowing Connections

CMMC Level 2SPRS if unmet: -1MEDIUM priority~6h to implement

Authorize wireless access to the system prior to allowing such connections.

What AC.2.016 means in plain English

Before any device can connect to your business Wi-Fi network (especially the one that touches your CUI/contract data), it should be approved and authorized. This means having a documented list of which devices are allowed on your business network, and not just having an open Wi-Fi with a password that anyone who knows it can use. Personal smartphones and guest devices should never be on the same network as your work computers.

The assessment question

“Is your business Wi-Fi network configured so that only authorized, company-approved devices can connect to the network where CUI is stored or processed — for example, through MAC address filtering, device certificates, or a separate guest network that is isolated from business systems?”

How to implement AC.2.016

Create two separate Wi-Fi networks on your business router: one for company computers and devices (the "CUI network"), and a completely separate guest/personal network for visitors and personal phones. Most modern business routers support this for free.
Maintain an inventory list of all authorized devices (company laptops, workstations, printers) that are allowed on the CUI network. Include device name, MAC address, and owner.
Enable MAC address filtering on your CUI network Wi-Fi: in your router admin panel, set up a whitelist of approved MAC addresses. Only devices on the list can connect. Note: this is a basic control and should be combined with WPA3 or WPA2-Enterprise.
For stronger security, deploy WPA2-Enterprise (802.1X) authentication using a RADIUS server — Ubiquiti UniFi and similar business routers support this and it requires certificate-based authentication, not just a password.
Document wireless access authorization in your Access Control Policy: who approves devices, how devices are added to the approved list, and how often the list is reviewed.

Evidence your assessor will ask for

Router/access point configuration screenshot showing separate CUI and guest networks (VLANs)
Authorized wireless device inventory list
MAC address filtering configuration screenshot
Written Wireless Access Policy
Network diagram showing Wi-Fi network segmentation

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.016 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Access Control