Wireless Access Point (WAP)

Applies to. Wireless access points are named directly in four requirement areas. For wireless environments connected to the CDE or transmitting account data, default passwords on access points and other wireless vendor defaults are changed or confirmed secure at installation (2.3.1); physical access to access points inside the facility is restricted (9.2.3); the presence of authorised and unauthorised access points is tested for and identified at least once every three months, with alerts to personnel where automated monitoring is used (11.2.1), against a maintained inventory of authorised access points with a documented business justification (11.2.2). Detection of unauthorised access points is one of the alert sources the incident response plan must cover (12.10.5).

Limits. 11.2.1 is met by testing for and identifying access points; it does not require a particular detection method or product, and it names automated monitoring only as an option that, if used, must alert personnel.