A legacy barcode-scanner SSID cannot move off weak crypto this quarter. What must the WLAN risk plan document?
Select an answer to reveal the explanation.
Short Explanation
Temporary ugly exceptions need a name on the door, a date on the calendar, and a boss who signed the residual risk. Hallway shrugs and hidden register rows are how legacy scanner SSIDs become permanent holes. Write the owner, the deadline, and the acceptance.
Full Explanation
When a legacy barcode-scanner SSID cannot move off weak crypto this quarter, the WLAN risk plan must document owners, deadlines, compensating controls, and formal residual-risk acceptance for that exception. A verbal hallway agreement with no owner or end date is not risk management. Declaring scanners exempt from all future security reviews forever creates unmanaged perpetual risk. Deleting the risk register entry so auditors never see the exception is concealment, not mitigation. Exam caveat: temporary exceptions require documented acceptance and compensating controls; silence or deletion fails lifecycle and audit expectations. Operational check: write the exception with named owner, compensating isolation/monitoring, executive signature, and sunset date; calendar the re-evaluation; and keep the record in the municipal GRC system. Verify compensating controls operate weekly until the scanners migrate. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.