A small municipal office proposes copying a 2008 WLAN policy template that still allows WEP. What should the advisor recommend?

A small municipal office that proposes copying a 2008 WLAN policy template still allowing WEP should reject that obsolete template and update policy to current WPA2/WPA3-era expectations. WEP is cryptographically broken and incompatible with modern municipal security baselines; retaining it in written policy invites auditors and attackers alike. Keeping WEP for "backward compatibility theater" with no upgrade plan perpetuates known-broken cryptography. Adopting the 2008 template unchanged because age supposedly proves maturity confuses longevity with soundness. Adding WEP plus TKIP together to "double" security preserves weak options that clients and attackers will prefer; stacking obsolete suites does not create defense in depth. If a handful of constrained devices remain, isolate them under explicit, time-bounded exceptions rather than resurrecting WEP in the master policy. Exam caveat: transitional exceptions for truly constrained devices must be explicit, segmented, monitored, and time-limited—not a blanket return to WEP citywide. Operational check: inventory any remaining WEP or TKIP clients, migrate or tightly isolate them, revise policy language to prohibit WEP and other deprecated ciphers, communicate the change to helpdesk and facilities, and re-approve the updated policy through the city's governance path.