I85PREP
⌘ K
CWSR study materials
CWSR study resources

CWSR: Wireless Security Policy, Compliance and Best Practices

CWSR · Work through your exam, one topic at a time.

All guide sections

Wireless Security Policy, Compliance and Best Practices

This domain tests whether you can turn technical controls into governed, auditable practice. Questions often present an auditor request or a policy gap and ask what document, control, or evidence satisfies it.

Document hierarchy

Policy states management intent and scope. Standards state mandatory technical requirements with measurable thresholds. Procedures describe the steps people follow. Guidelines are recommendations without mandatory force. A policy without an owner, a review cycle, and an exception process is not a control. Coverage should include acceptable use, authorized device types, minimum encryption, guest access, BYOD, credential and pre-shared key handling, monitoring and privacy notice, incident response, and exceptions with expiry dates.

Compliance touchpoints

  • PCI DSS: wireless in or near the cardholder data environment requires an inventory of authorized access points, periodic scanning for unauthorized wireless, and evidence of segmentation.
  • HIPAA Security Rule: administrative, physical, and technical safeguards, including transmission security for electronic protected health information.
  • NIST SP 800-53: control families such as access control, identification and authentication, system and communications protection, and audit and accountability. NIST SP 800-153 supplies WLAN-specific guidance.
  • ISO/IEC 27001 and 27002: the management system and the control catalog.
  • GDPR: lawful basis for processing, minimization of logged personal data, and retention limits.
  • Evidence: configuration exports, quarterly scan reports, certificate inventories, access review records, and closure tickets.

Technical baseline

WPA3-Enterprise or WPA2-Enterprise with EAP-TLS; PMF required where supported; WEP, TKIP, and WPS disabled; management traffic on a separate VLAN and SSID; unused services such as Telnet, console access, and legacy SNMP disabled or replaced with SNMPv3; firmware under change control and patched on a schedule; logs shipped to a SIEM with accurate NTP; where a pre-shared key is unavoidable, at least 20 random characters, rotated, escrowed, and never used for corporate data access.

Worked example

An auditor asks for proof that unauthorized wireless is detected. Submit the current access point inventory with locations and BSSIDs, four quarters of scan reports covering all sites, the policy clause naming the scan frequency and the responsible role, and the ticket showing the most recent rogue detection and its resolution. A screenshot from a tool without an owner, a schedule, and a closure record does not satisfy the requirement.

Traps that cost marks

  • Writing policy text with no enforcement mechanism and no exception route.
  • Treating a passed audit as proof of security rather than proof of documented control.
  • Naming controls without owners, frequencies, or evidence artifacts.