CIS Control 13.9: Deploy Port-Level Access Control
Port-level access control is your first line of defense against unauthorized network access. CIS Control 13.9 requires implementing 802.1X or similar network access control protocols with device and user authentication to prevent rogue devices from connecting to your network.
What this means
Port-level access control enforces authentication at the network switch or wireless access point level before a device gains access to your network. This control uses 802.1X, certificates, and user/device authentication mechanisms to verify that only authorized and compliant devices can connect to network ports—blocking unknown or non-compliant devices at the point of entry.
How to comply
- 1.Implement 802.1X authentication on all network switches and wireless access points
- 2.Deploy certificate-based authentication for device identity verification
- 3.Configure device and user authentication requirements before network access is granted
- 4.Maintain a repository of authorized device certificates and credentials
- 5.Monitor failed authentication attempts and quarantine non-compliant devices
- 6.Test port-level access controls quarterly to ensure effectiveness
- 7.Document your port-level access control policy and deployment architecture
Evidence auditors look for
- 802.1X configuration snapshots from network switches and access points
- Certificate repository and device authentication logs
- Quarterly port-level access control testing reports
- Network access control policy documentation
- Failed authentication attempt logs showing quarantine actions
- Device compliance verification procedures
- Network topology diagrams showing 802.1X deployment
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates 802.1X deployment verification and certificate lifecycle management, eliminating manual audits of port-level access control configurations across all network devices.
See how GRCWatch handles this control automatically
Start free trial