City leadership wants WLAN security policy "based on industry standards" without inventing home-grown crypto rules. What advice aligns with CWSP policy practice?
Select an answer to reveal the explanation.
Short Explanation
Don't invent your own "CityCipher." Point policy at known wireless security standards and best practices so auditors and vendors speak the same language.
Full Explanation
When city leadership wants WLAN security policy "based on industry standards" without inventing home-grown crypto rules, CWSP policy practice is to align WLAN security policy with accepted industry standards and best practices for wireless authentication and encryption rather than ad-hoc cryptographic invention. Municipal environments benefit from well-reviewed guidance on WPA2/WPA3, EAP methods, management-plane hardening, and segmentation instead of unique city-only cipher suites that no vendor or auditor understands. Inventing proprietary cipher suites unique to the city creates unmaintainable, untested cryptography and complicates vendor support. Copying a blog comment thread as the formal standard lacks review, versioning, and accountability. Relying solely on cute SSID names as the security baseline provides no authentication, encryption, or monitoring control. Aligning to industry practice also eases staffing, procurement, and audit conversations across departments. Exam caveat: "industry standards" in exam language means current enterprise WLAN security practices and hardening baselines—not inventing algorithms or treating informal posts as normative. Operational check: cite the standards or frameworks the policy inherits, explicitly prohibit deprecated suites such as WEP and weak legacy ciphers in the standards tier, and require architecture reviews to justify any deviation with owners, compensating controls, and sunset dates.