ASD ISM 1314 Ensure wireless devices are Wi-Fi Alliance certified
What it says
All wireless devices are Wi-Fi Alliance certified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll wireless devices must have Wi-Fi Alliance certification for security standards.
This control means that any wireless devices your organisation buys or uses should have a seal of approval from the Wi-Fi Alliance. This matters because it ensures these devices stick to important security standards. Without this certification, there's a risk that the devices could have security flaws, making your network vulnerable to hackers snooping in or stealing sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without Wi‑Fi Alliance certification, Wi‑Fi devices may lack verified security and interoperability, increasing the risk of weak encryption, misconfiguration and unauthorised access.
How to implement
IT managers should create a list of all existing wireless devices currently in use and verify their certification status with the Wi-Fi Alliance.
Use the Wi-Fi Alliance website to cross-check each device model.
System administrators should educate staff involved in purchasing on the importance and recognition of the Wi-Fi Certified logo.
This can be done through a simple workshop or information session highlighting the risks of using uncertified devices.
IT teams should establish a process to regularly review and update the inventory of wireless devices, ensuring ongoing compliance.
This could be done quarterly, where devices are re-checked for their certification status.
Leadership should define and enforce a policy that prohibits the use of uncertified wireless devices within the organisation.
Communicate this policy through staff meetings, emails, and inclusion in the organisation's handbook.
Keep it running
Maintain an approved device register and verify Wi‑Fi Alliance certification (model/firmware) during procurement and onboarding; periodically re-check certification for fleet changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The procurement records of wireless devices: Request to see purchase orders or receipts for all wireless devices to confirm they feature Wi-Fi Alliance certification.
Look at
The Wi-Fi Certified logo or related documentation.
Good evidence
Includes clear documentation showing each device's certification status.
- Check 2 of 5What an auditor asks for
Ask for
The inventory list of all wireless devices: Review this list against the Wi-Fi Alliance database. Look to ensure every device listed is verified as certified.
Good evidence
Is when all listed devices are confirmed as certified on the Wi-Fi Alliance's site.
- Check 3 of 5What an auditor asks for
Ask for
Training materials provided to the purchasing team.
Look at
The content to see if they explain the importance of Wi-Fi certification.
Good evidence
Shows that staff were informed about the certification and why it matters.
- Check 4 of 5What an auditor asks for
Ask for
To see the policy on wireless device usage: Ensure it clearly mandates using Wi-Fi Certified devices.
Look at
Specific language mentioning the Wi-Fi Alliance certification.
Good evidence
Includes a documented and widely communicated policy.
- Check 5 of 5What an auditor asks for
Ask for
Records of compliance checks or audits.
Look at
Results from periodic checks of wireless devices to ensure ongoing compliance.
Good evidence
Includes documented evidence of regular device compliance reviews and any actions taken for non-compliance.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1314 requires that all wireless devices used by the organisation are Wi‑Fi Alliance certified. This is a specific procurement/allowlisting constraint that contributes to Annex A 8.20 (Network and Network Devices Security) by reducing the likelihood of deploying wireless network devices with non-standard or weak security capabilities. Annex A 8.20 is broader because it covers the full lifecycle of securing, managing and controlling networks and network devices (including configuration, monitoring and access controls), while ISM-1314 only addresses a certification attribute for wireless devices.
This control partially meets A.8.21.
ISM-1314 requires that all wireless devices are Wi‑Fi Alliance certified, effectively setting a minimum standard for wireless device capability and conformance. This relates to Annex A 8.21 (Security of Network Services) where network service security mechanisms and requirements must be identified and implemented; using certified devices can help ensure the service can meet expected Wi‑Fi security mechanisms (e.g. standards-based authentication/encryption support). Annex A 8.21 is broader because it focuses on defining, delivering and monitoring network service security and service levels, not on device certification as an entry criterion.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.