Identify all wireless networks transmitting CHD or connected to the CDE; verify industry best practices are used and weak encryption is not used.

• A. Identify all wireless networks transmitting CHD or connected to the CDE; verify industry best practices are used and weak encryption is not used.
• B. Identify wireless networks but ignore encryption strength.
• C. Identify only wired networks; ignore wireless.
• D. Assume wireless networks are secure by default.

Answer: (A)

The essential idea is to have complete visibility of every wireless network that transmits cardholder data or connects to the Cardholder Data Environment, and to ensure those networks use current security practices with strong encryption. Identifying all relevant wireless networks lets you spot rogue or misconfigured points and apply proper controls, instead of leaving a gap where CHD could leak or be exposed. Verifying that industry best practices are used and that weak encryption is not used ensures that wireless transmissions of CHD are protected with strong crypto (for example, WPA2/WPA3 with AES) and that the network is properly authenticated, segmented, and monitored.

Options that ignore encryption strength, focus only on wired networks, or assume security by default don’t meet the requirement to protect wireless CHD transmissions and to verify controls in the CDE, so they aren’t appropriate.