After a city migrates enterprise SSIDs to WPA3-Enterprise, what policy-lifecycle action is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
New locks on the building mean you update the facilities binder—not shred it. After WPA3, revisit policy on a cadence so exceptions, old AKMs, and monitoring rules match reality. “Set and forget” is how shadow WPA2 SSIDs survive.
Full Explanation
After enterprise SSIDs migrate to WPA3-Enterprise, policy lifecycle work is not finished at cutover. Scheduling a security-policy review cadence so AKM, exception, and monitoring language match the new WPA3 posture keeps written policy aligned with what controllers actually enforce for city staff. Municipal auditors, new hires, and help-desk scripts otherwise inherit WPA2-era exception text that no longer describes the live network and quietly authorize the wrong behaviors.
Freezing all policy documents permanently because “WPA3 ends reviews” ignores transitions, device exceptions, and future band or PMF features. Keeping WPA2-only policy text unchanged leaves gaping mismatches for Transition Mode or legacy waivers. Deleting incident-response playbooks that mention wireless authentication throws away operational muscle memory during the migration window when failures are most likely.
Exam caveat: review cadence should be risk-timed—after major AKM changes and on a recurring governance cycle—not only after breaches. Operational check: open the WLAN security policy, confirm WPA3 AKM and monitoring language match production SSID profiles, update exception registers, and schedule the next review date in the city’s governance calendar.