ASD ISM 1335 Enabling 802.11w to protect wireless management frames
What it says
Wireless access points enable the use of the 802.11w amendment to protect management frames.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure wireless networks use the 802.11w standard to secure management frames from tampering.
Making sure your wireless networks use the 802.11w standard means the management instructions sent over Wi-Fi are protected from being messed with by any meddler. If this isn't done, a hacker could trick the network into dropping users or cause general chaos, which could disrupt business or school activities.
Free. Save your status, tasks and notes.
Why it matters
Without 802.11w, attackers can spoof/deauth management frames to disrupt Wi‑Fi and enable evil twin/traffic capture, harming continuity.
How to implement
The IT team should ensure all wireless access points are configured to use the 802.11w standard.
They can do this by checking the settings in the management interface of each device and enabling the 802.11w option if it's not already turned on.
Network administrators should update all wireless device firmware to the latest version that supports 802.11w.
This can typically be done by downloading updates from the manufacturer's website and following the installation instructions.
The procurement officer should confirm that any new wireless devices purchased support 802.11w.
When buying new equipment, they should check the technical specifications or ask vendors directly about 802.11w compatibility.
IT support staff should educate employees about the importance of network security features such as 802.11w.
A short workshop or training session can help staff recognise why these protections are important for preventing wireless attacks.
The IT manager should regularly review and test the wireless network's security settings, including the 802.11w configuration, to ensure compliance.
They could schedule quarterly checks, testing the network with security tools to confirm 802.11w is active and functioning.
Keep it running
Regularly confirm 802.11w (PMF) is enabled on all APs/SSIDs (preferably required), and monitor for spoofed deauth/disassoc events.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network configuration report: Request the documentation showing current wireless network settings.
Look at
The configuration to see if 802.11w is enabled on all access points. Good means all settings confirm that 802.11w is active.
- Check 2 of 5What an auditor asks for
Ask for
Firmware update logs: Request records of recent firmware updates for all wireless devices.
Look at
These logs for 802.11w mentions or updates that include this feature. Good means logs clearly show updates related to security standards like 802.11w.
- Check 3 of 5What an auditor asks for
Ask for
Purchase records of wireless devices: Request documentation for the latest wireless hardware purchases.
Look at
The specifications of the devices bought to confirm they support 802.11w. Good means all new purchases list 802.11w as a feature.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of training sessions: Request records of any recent staff training on network security.
Look at
Session topics for coverage of wireless security and standards like 802.11w. Good means training included content on why 802.11w is important.
- Check 5 of 5What an auditor asks for
Ask for
The last security audit results: Request the results of the most recent internal or external review of the wireless network's security.
Look at
Recommendations related to 802.11w or its acknowledgment in audit results. Good means findings confirm 802.11w is enabled and effective.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
Annex A 8.20 requires secure management and control of networks and network devices to protect information from unauthorised access or interference. ISM-1335 maps to this by requiring 802.11w on wireless access points to protect management frames, mitigating deauthentication/disassociation attacks that can disrupt connectivity or aid interception. Annex A 8.20 is broader as it includes wider WLAN design and network device security requirements beyond management-frame protection.
This control partially meets A.8.21.
ISM-1335 mandates enabling 802.11w to protect wireless management frames against manipulation. Annex A 8.21 requires the identification, implementation, and monitoring of appropriate security mechanisms for network services, including secure WLAN service configurations. ISM-1335 is a specific WLAN security mechanism, while Annex A 8.21 covers a wider set of network services, and associated service levels and monitoring.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.