NIST SP 800-171 Rev 2 · 3.1 Access Control

3.1.18 Control mobile device connections

Control connection of mobile devices.

SPRS weight

5

5 points deducted from 110 when not implemented.

CMMC level

L2

Level 2 only; not among the 17 Level 1 practices.

Assessment objectives

3

From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.1.18 into 3 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

1. [a]Determine if mobile devices that process, store, or transmit CUI are identified.
2. [b]Determine if the connection of mobile devices is authorized.
3. [c]Determine if mobile device connections are monitored and logged.

Examine

[SELECT FROM: Access control policy; authorizations for mobile device connections to organizational systems; procedures addressing access control for mobile device usage (including restrictions); system design documentation; configuration management plan; security plan; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

Interview

[SELECT FROM: Personnel using mobile devices to access organizational systems; system or network administrators; personnel with information security responsibilities].

Test

[SELECT FROM: Access control capability authorizing mobile device connections to organizational systems].

If it is open: POA&M eligibility

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

Where 3.1.18 maps

Query it from your own tools

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.1.18
get_assessment_objectives 3.1.18
generate_poam_entries ["3.1.18"]

Install the MCP server, free, no account.