NIST 800-171 R3 03.01.18 Access Control for Mobile Devices at a Glance
- Family: 03.01 Access Control (AC)
- Requirement ID: 03.01.18 Access Control for Mobile Devices
- Assessment Objectives (AOs): Five (5) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Controls: AC-19, AC-19(05)
- NIST 800-171 R3 Kill Chain Phase: Phase 17, Layered Network Defenses
Access Control for Mobile Devices governs how phones, tablets, and similar portable devices connect to your system and how Controlled Unclassified Information (CUI) on them is protected. It sits near Wireless Access (03.01.16), but the two are different: wireless access is about the connection technology, while Access Control for Mobile Devices (03.01.18) is about the devices themselves. It does three things: establish usage, configuration, and connection requirements for mobile devices, authorize the connection of mobile devices to the system, and implement full-device or container-based encryption to protect the confidentiality of CUI on those devices. Per the NIST discussion, a mobile device is a small form factor computing device designed to operate without a physical connection, and examples include smart phones, smart watches, and tablets, with some organizations also treating notebook computers as mobile devices.
A common difficulty with this requirement is assuming a mobile device management tool with encryption turned on covers it. Encryption is only one of the three (3) parts. R3 also expects documented usage, configuration, and connection requirements for mobile devices and an explicit authorization for connecting them, and two of those objectives have no clear R2 predecessor, so they are effectively new documentation work.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.01.18 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.01.18 Access Control for Mobile Devices. Only the formatting has been adjusted for readability. This requirement has three (3) lettered parts:
- a. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices.
- b. Authorize the connection of mobile devices to the system.
- c. Implement full-device or container-based encryption to protect the confidentiality of CUI on mobile devices.
The source controls are AC-19 and AC-19(05) from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, usage restrictions and configuration and connection requirements for mobile devices can include configuration management, device identification and authentication, mandatory protective software, malicious code scanning, and disabling unnecessary hardware, and container-based encryption provides software-based isolation that segments enterprise applications and information from personal apps and data. You can read the requirement directly at NIST 800-171 R3, 03.01.18 (p. 16).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.01.18?
None (0). Requirement 03.01.18 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.01.18 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.01.18?
NIST 800-171A R3 breaks 03.01.18 into five (5) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.01.18.a[01]: usage restrictions are established for mobile devices.
- A.03.01.18.a[02]: configuration requirements are established for mobile devices.
- A.03.01.18.a[03]: connection requirements are established for mobile devices.
- A.03.01.18.b: the connection of mobile devices to the system is authorized.
- A.03.01.18.c: full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.
The five (5) objectives split part a into three (usage restrictions, configuration requirements, and connection requirements), plus the authorization and the encryption. Each is separately assessed, so a mobile device management deployment that encrypts data but has no documented usage restrictions still leaves objectives open. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.01.18 (p. 19).
Assessment Methods and Objects for NIST 800-171 R3 03.01.18
Examine: access control policy and procedures; procedures for mobile device access control; system design documentation; configuration management plan; 19 NIST SP 800-171Ar3 Assessing CUI Security Requirements May 2024 system configuration settings; authorizations for mobile device connections to organizational systems; system audit records; encryption mechanisms and associated configuration documentation; system security plan.
Interview: personnel with access control responsibilities for mobile devices; personnel using mobile devices to access organizational systems; personnel with information security responsibilities; system administrators.
Test: access control capability for mobile device connections to organizational systems; encryption mechanisms for protecting the confidentiality of CUI on mobile devices; configurations of mobile devices.
How Does NIST 800-171 R3 03.01.18 Map From NIST 800-171 R2?
03.01.18 maps from NIST 800-171 R2 requirement 3.1.18 (control connection of mobile devices), and it absorbs R2 requirement 3.1.19 (encrypt CUI on mobile devices and mobile computing platforms):
- A.03.01.18.b and A.03.01.18.c map directly to elements of R2 3.1.19 (authorize connection and implement encryption).
- A.03.01.18.a[03] maps indirectly to elements of R2 3.1.18[b] (connection requirements).
- A.03.01.18.a[01] and A.03.01.18.a[02] have no clear mapping to any R2 AO.
Mapped against the five (5) AOs, two (2) are direct (minimal effort), one (1) is indirect (moderate effort), and two (2) have no clear mapping (significant effort), with none net new. The connection authorization and encryption carry forward, but the usage restrictions and configuration requirements for mobile devices are effectively new documentation, since they do not trace cleanly to a R2 objective.
How Does NIST 800-171 R3 03.01.18 Map to NIST 800-53 R5 and the SCF?
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.01.18 through the following SCF controls:
- AST-02 Asset Governance
- AST-25 Use of Personal Devices
- AST-26 Use of Third-Party Devices
- AST-27 Bring Your Own Device (BYOD) Usage
- AST-28 Usage Parameters
- CFG-04 Secure Baseline Configurations
- HRS-06.1 Rules of Behavior
- HRS-06.3 Technology Use Restrictions
- HRS-06.5 Use of Mobile Devices
- HRS-07 Access Agreements
- IAC-02 Identity & Access Management (IAM)
- IAC-34 Identification & Authentication for Devices
- IAC-35 Access Control For Mobile Devices
- MDM-02 Centralized Management Of Mobile Devices
- MDM-03 Restricting Access To Authorized Technology Assets, Applications and/or Services (TAAS)
- MDM-04 Full Device & Container-Based Encryption
- MDM-06 Personally-Owned Mobile Devices
- MDM-07 Organization-Owned Mobile Devices
- NET-02 Network Security Controls (NSC)
- NET-03 Boundary Protection
- SEA-04 Alignment With Enterprise Architecture
- SEA-05 Secure Engineering Principles
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.01.18
The following are issues teams may encounter rather than certainties. They are about the documentation objectives and scope, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Encryption is not the whole requirement. A.03.01.18.c (full-device or container-based encryption) is one of five (5) objectives. Usage restrictions, configuration requirements, connection requirements, and connection authorization are each assessed separately.
- Two (2) objectives have no R2 predecessor. A.03.01.18.a[01] (usage restrictions) and a[02] (configuration requirements) have no clear R2 mapping, so plan to write them rather than copy them forward.
- Decide what counts as a mobile device. Per the NIST discussion, some organizations treat notebook computers as mobile devices. Your scope decision affects which devices these objectives apply to, so document it.
- Full-device or container-based both qualify. A.03.01.18.c accepts either full-device encryption or container-based encryption. Container-based isolation that segments enterprise data from personal data is an acceptable path for protecting CUI confidentiality.
What Is Reasonable Evidence For NIST 800-171 R3 03.01.18?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.01.18 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.01.18 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-01 IT Asset Management (ITAM). An it asset management (itam) program that addresses the due diligence and due care activities associated with maintaining both secure, compliance and resilient technology assets, applications and/or services (taas).
- E-AST-12 Secure Baseline Configurations Reviews. A review process to ensure secure baseline configurations (sbc) are current and applicable (e.g., system configuration settings and associated documentation).
- E-AST-13 Secure Baseline Configurations - Cloud-Based Services. Secure baseline configurations for all deployed types of cloud-based services or applications.
- E-AST-14 Secure Baseline Configurations - Databases. Secure baseline configurations for all deployed types of databases.
- E-AST-15 Secure Baseline Configurations - Embedded Technologies. Secure baseline configurations for all deployed types of embedded technologies.
- E-AST-16 Secure Baseline Configurations - Major Applications. Secure baseline configurations for all deployed types of major applications.
- E-AST-17 Secure Baseline Configurations - Minor Applications. Secure baseline configurations for all deployed types of minor applications.
- E-AST-18 Secure Baseline Configurations - Mobile Devices. Secure baseline configurations for all deployed types of mobile devices.
- E-AST-19 Secure Baseline Configurations - Network Devices. Secure baseline configurations for all deployed types of network devices.
- E-AST-20 Secure Baseline Configurations - Server Class Systems. Secure baseline configurations for all deployed types of server-class operating systems.
- E-AST-21 Secure Baseline Configurations - Workstation Class Systems. Secure baseline configurations for all deployed types of workstation-class operating systems.
- E-HRS-16 Access Agreements. Personnel management practices protecting sensitive/regulated data through formal access agreements.
- E-HRS-22 Rules of Behavior. Personnel management practices to define "acceptable use" or "rules of behavior" criteria that specify acceptable and unacceptable user behaviors.
- E-IAC-05 Identity & Access Management (IAM) Function. An identity & access management (iam), or similar function, that facilitates the implementation of identification and access management controls.
- E-IAC-06 Authenticate, Authorize and Audit (AAA) Solution. An authenticate, authorize and audit (aaa) solution (on-premises and hosted by external service providers (esp)).
- E-MDM-01 Mobile Device Management (MDM) Configuration. Mobile device management (mdm) configuration, including centralized management, access restrictions for unauthorized devices, device / container encryption, separate profiles and geofencing.
- E-MDM-02 Mobile Device Ownership & Enrollment Inventory. Enrolled mobile devices by ownership model (organization-owned, personally-owned / byod, third-party devices).
- E-NET-04 Network Security Controls (NSC). The organization's network security controls (e.g., boundary protections, content filtering, wireless infrastructure, etc.).
- E-NET-07 External System Accessibility. A list of technology assets, applications and/or services (taas) accessible from third-party entities.
- E-NET-08 Internal Boundaries. Key internal boundaries.
- E-NET-09 Network Access Control Points. Network access control points.
- E-SEA-02 Security Architecture. Security architecture-related documentation.
- E-TDA-02 Secure Engineering & Data Privacy (SEDP). A secure engineering & data privacy (sedp) program. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-TDA-08 Secure Engineering Principles (SEP). Defined secure engineering principles used to ensure sensitivity, integrity, availability & safety (cias) concerns are properly addressed in the design and implementation of technology assets, applications and/or services (taas).
- E-TDA-09 Security Architecture View. Documented evidence that identifies security-relevant system elements and their interfaces: • define security context, domains, boundaries, and external interfaces of the system; • align the architecture with (a) the system security objectives and requirements, (b) security design characteristics; and • establish traceability of architecture elements to user and system security requirements.
Alongside these, keep the System Security Plan (SSP) narrative for 03.01.18.
Timeline Considerations for NIST 800-171 R3 03.01.18
Two (2) of the five (5) AOs have no clear R2 mapping, so 03.01.18 carries real documentation work even though nothing is strictly net new. A realistic sequence:
- Establish usage restrictions and configuration requirements for mobile devices (A.03.01.18.a[01] and a[02]), the objectives with no clear R2 predecessor.
- Establish connection requirements for mobile devices (A.03.01.18.a[03]).
- Authorize the connection of mobile devices to the system (A.03.01.18.b).
- Implement full-device or container-based encryption to protect CUI on mobile devices (A.03.01.18.c).
- Collect evidence for all five (5) AOs, including the mobile device policy, configuration baselines, connection authorizations, and encryption configuration.
Frequently Asked Questions About NIST 800-171 R3 03.01.18
How many assessment objectives does NIST 800-171 R3 03.01.18 have? NIST 800-171A R3 breaks 03.01.18 into five (5) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.01.18 come from? AC-19, AC-19(05).
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.01.18 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.01.18 sit in the NIST 800-171 R3 Kill Chain? Phase 17, Layered Network Defenses. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.01.18
03.01.18 Access Control for Mobile Devices sets usage, configuration, and connection requirements for mobile devices, authorizes their connection, and requires full-device or container-based encryption for CUI on them. It maps from R2 3.1.18 and absorbs 3.1.19, but two of its five (5) assessment objectives have no clear R2 mapping, so the usage and configuration requirements are effectively new. The recurring problem is assuming encryption alone satisfies it. Write the mobile device usage, configuration, and connection requirements, authorize connections, encrypt CUI, and keep the policy and configuration as evidence.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
