A county WLAN draft only says staff shall not do bad things on Wi-Fi and lists no enforceable rules. How should the security lead rewrite it into high-level policy statements?

A county WLAN draft that only says staff shall not do bad things on Wi-Fi and lists no enforceable rules must be rewritten into high-level policy statements that name required controls in clear language—such as strong authentication for staff WLAN, guest isolation from staff and payment segments, and restricted administrative access to controllers and APs. Vague exhortations cannot be audited, trained, or enforced by helpdesk and operations. Keeping the slogan and attaching a one-page glossary of RF terms adds vocabulary without creating enforceable outcomes. Replacing the draft with a channel plan and AP density table confuses RF design artifacts with security policy. Deleting written policy entirely and relying on help-desk tickets when someone complains about Wi-Fi abuse guarantees inconsistent, after-the-fact responses. High-level municipal policy should state what must be true so standards and procedures can specify EAP methods, cipher suites, and operating steps. Exam caveat: policy statements remain technology-neutral enough to survive platform refresh while still being specific enough that an auditor can test for presence of authentication, isolation, and admin control. Operational check: replace slogan text with testable statements, map each statement to a standard or procedure, obtain approval through the county policy process, and sample controller configurations to confirm staff authentication, guest isolation, and admin AAA match the written controls.