NIST 800-171 3.1.18 (AC.L2-3.1.18): Mobile Device Connection

What 3.1.18 means in practice

Phones and tablets that touch CUI are known and may connect only under your rules. In practice that means enrollment in device management, a compliance policy (passcode, current software, no jailbreak) and sign-in rules that admit only compliant or approved devices, with their connections logged.

SPRS points and the CMMC POA&M

What an assessor checks for 3.1.18

NIST SP 800-171A gives 3 determination statements for 3.1.18, each found satisfied or other than satisfied. Determine if:

1. 3.1.18[a] mobile devices that process, store, or transmit CUI are identified.
2. 3.1.18[b] mobile device connections are authorized.
3. 3.1.18[c] mobile device connections are monitored and logged.

NIST SP 800-171A (June 2018), assessment objectives for 3.1.18

Evidence that shows 3.1.18 is met

• An inventory of the mobile devices that process, store or transmit CUI.
• Mobile device management compliance policies.
• Sign-in rules that require a compliant device or an approved app.
• Logs of mobile device connections.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.1.18 from it. Each line says what the product checks.

• Microsoft Intune: Compliance policies · Device configurations. Checks that the compliance policies reaching every iOS and Android device Intune manages require authentication and block jailbroken or rooted devices.
• Microsoft Entra ID: Conditional Access. Checks that Conditional Access requires a compliant device, an approved app or an app protection policy for iOS and Android sign-ins, or blocks them.